Extracted

• • Target

    a2e025670dcf3d092a16eb81757cb3d9_JaffaCakes118

  • Size

    870KB

  • MD5

    a2e025670dcf3d092a16eb81757cb3d9

  • SHA1

    a5b57bd65d225e5204fd54215a8df5307bb5567f

  • SHA256

    bf8e8b067add7906637272a48bd344a01837bfa7add6e48cf833b8e70cf6a25a

  • SHA512

    f731ada5753279f94a58f493554cea3ff3dcd6da9bca0cd8166793f125c7b728604d05a2ab60b65c79858b38925f6c404418123abc55afc90e1c0df2b541fd6b

  • SSDEEP

    24576:aaojuhLcuESLjk7PxT3ZXYMtAZmcK++JvYyt:GShXHLjsrXYM+s+avYyt

  Score

  10^/10

  cybergatecarpe diemdiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2