Extracted

• • Target

    JaffaCakes118_b95b79ff73d0008b7be786ac1286403d

  • Size

    556KB

  • MD5

    b95b79ff73d0008b7be786ac1286403d

  • SHA1

    32b4eb61444521dc8cd24d74e65847d3191396c2

  • SHA256

    604f57219c56d6c0a36644b7f7ac1af2e283a32549a4d5503c090c957858c928

  • SHA512

    37d4e893f90ace2da069aae908d0a83a3a60fc1a9900577f06af5c11e9093269da56cd3815cfcdc09bf7117d16d90fc766989f9b2e9af61e9a498df19cdcee8d

  • SSDEEP

    12288:onBSnmLHNhNgBu+5DDmsJRlOOyk+DRTUC9XXZT+oivMu:SEK0BuS/bJ7OOcv9nkZ

  Score

  10^/10

  cybergatenewwwdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1