Extracted

• • Target

    JaffaCakes118_b6d5bd2b14f865af2bac06562574ac69

  • Size

    1.0MB

  • MD5

    b6d5bd2b14f865af2bac06562574ac69

  • SHA1

    03b1c206a153300ed5b3bf238d0c9ad860042e59

  • SHA256

    bf35c5e0dc004794f6e60a1f4e195a8db2db09e33a4cb44151f03d5dceeafda7

  • SHA512

    64245e4bbd72d116e5d519794a7736d3fddf1273c2df6f6822802848e6da46563752043f4bc4c726aae63c48390963958d30d0a8bd8a310d7c6ab496a6935b55

  • SSDEEP

    12288:HxizLNLGepwpVpUpHH+jNizLNLGepwpVpUpHyB02bLD1cl25JtUu/qBiNB:0zLNL4czLNLwvbH1+eJtUi

  Score

  10^/10

  cybergateobadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1