Extracted

• • Target

    JaffaCakes118_b956b8e610886afd698fefbcbe05b5de

  • Size

    346KB

  • MD5

    b956b8e610886afd698fefbcbe05b5de

  • SHA1

    f24cb625d56704dce4df2fa254aa1b86c7bebc8f

  • SHA256

    ddc172043b336fa893e8823372df1b7f510651f83d1178628fa4dff352b90184

  • SHA512

    19b1b6a64e280e0eda90457c3e4ea3f955921cda96d91cb8cbdb10fdf963505ede66c8bb16230d418a03088183484cf002403e41b02e6bee4e7a97ea3024edd1

  • SSDEEP

    6144:JTHlh+Jgu4Rx8LMOpbRfQVPW5eWMM1m1Ycmfjs7mBzMgOsbKNZOR0Yv4b/TkOkgc:NySmfAKRvKNZk0YUHrs8I62L

  Score

  10^/10

  cybergatenew0525discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1