Extracted

• • Target

    JaffaCakes118_b7d17f5d144d4ffdc50395660a0a1934

  • Size

    508KB

  • MD5

    b7d17f5d144d4ffdc50395660a0a1934

  • SHA1

    38f4faaa96ec860ae68b1d5e84224b3a36f49dff

  • SHA256

    9c2e4a11035905d0f5be22bd312cc604d0d95a4dfa234a185b76e252fae3487b

  • SHA512

    bc1e82a9def73c69564495542493b334e419cadfc6e0e1969ed7cd7bed23f86d559fa87a3d04a3bc908204e85fa4fa7f28a8270b13d13eadff556646883a02a7

  • SSDEEP

    12288:VRmUv9M4mb1se0y5nxtOH9Q+6mK/rj/e99E7nLN493wF:VRmKMh0yRxIa7/Xo9unx

  Score

  10^/10

  cybergate0discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1