Extracted

• • Target

    afde651c3e7e6ff69914a00fb097d3cb_JaffaCakes118

  • Size

    453KB

  • MD5

    afde651c3e7e6ff69914a00fb097d3cb

  • SHA1

    0e4f9852f0570e080a0693ef4452f9825178a0a8

  • SHA256

    591dc308bbd6ed79c1c83a7e474811dbd3dff12a6db804ca81a02aee2f0a9c86

  • SHA512

    b5c10f493e543b9ba592777ed183030dd24cd33f465fe400f75fea12d23b92086f9c2e62f23d35f0301ef00ff968220ffe7b8ca601524b928e36828d7a94ab83

  • SSDEEP

    12288:cUIVS3/VaEIGSJQo12wSMe8otvmWCq7ZR:MsNaEIGYl1UMjKmW5

  Score

  10^/10

  cybergateseafight botdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2