Extracted

• • Target

    ade892aa505efca90e9619d379a60d1c_JaffaCakes118

  • Size

    780KB

  • MD5

    ade892aa505efca90e9619d379a60d1c

  • SHA1

    c4172c36e132f5520260c7ddd7c067bb0fa647c0

  • SHA256

    3dbda00f0c64f9536a9af02754a0ffe506390450e4ac9ec3a88c8810558b21ad

  • SHA512

    693322877d46e15df0a7f3c7bec5290471770a8cea0da63f8a525e672779cfdcf81e0c8b194c7896918df7d07f11c1bd8e52d49c64ceb94582511b302159ca11

  • SSDEEP

    12288:GdlOOwjvfUj1GqjcYUJtP/QOng33UzsBWxbtRXEXmbj6DSUeBr:GdlOOwjvfY1jXUJt/tn9zjp5E26D8Br

  Score

  10^/10

  cybergateironhanddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2