Extracted

• • Target

    d2040bfe23e556fa98a8b650d7a6179b_JaffaCakes118

  • Size

    1.2MB

  • MD5

    d2040bfe23e556fa98a8b650d7a6179b

  • SHA1

    43d1c92faf52c642f2e2f2b294c8e5aed09b97c5

  • SHA256

    20b5b6d5b187f8efd595ed51f1b3289b4564f5166d4d1abd682c32b7248afc1d

  • SHA512

    3913abdb570684d97e71ed948019836164cfe409fbfe2e8f0cea326fef40c545a3afddcacd96fe001378872f3d654864373a8c5d00009bf113771cab652a2709

  • SSDEEP

    12288:SRiU/5eszhQ+9sqcVUgilY7dWEpmc3Ne1VEcsrviK7M:JTIQ+9sqcVUlupPde/5sRM

  Score

  10^/10

  cybergatealtvicadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2