Extracted

• • Target

    9edbd70f469f38f0fcf5a1e9b6100189_JaffaCakes118

  • Size

    1.2MB

  • MD5

    9edbd70f469f38f0fcf5a1e9b6100189

  • SHA1

    8948e087b4e0df3b15851f8f4f459f86015ee82e

  • SHA256

    ea1b64729cb531c6a8bed9ef45e4d6ed40e04715a4f385224254f9f2b7449c75

  • SHA512

    15a05ba6db95722fe1434ba7b8107d194cf59af959fa7804bcc937f254fff23345d7d8cefb99e3ed2249dfdf7a9c0282d37fec15927487bd7d49d08d44ca0f3d

  • SSDEEP

    12288:+ckvkwUjD2xDvLCPFGakc8d0g5LQfsVRG8hoGvDUF8GGGHXDlxlI/A/EUdeocznQ:tO7k2A3vHnlIsAznuGAKoOqea9/aC

  Score

  10^/10

  cybergatecyberdiscoveryevasionpersistenceprivilege_escalationstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2