Extracted

• • Target

    b43cd5aff145788f3b62a2f2f0b1e4aa_JaffaCakes118

  • Size

    1.3MB

  • MD5

    b43cd5aff145788f3b62a2f2f0b1e4aa

  • SHA1

    a4cb919dea8ef9ae706c3ec6fdeebbb6d0039b95

  • SHA256

    90fa1b3a2438c3385fe0f09cd683d10b5d69db9b9af4dfa15c20f3389b288704

  • SHA512

    14b929691341049250e9c85ac0cbee2124bad949925c7d6a3c5963d15f8ef8da578f6e6ea7971a1b35ba5dcbc7dd8de6b8cc59a5211d93523d91d9124159b29c

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iapZ3IIIk2KqFNaD23Nll3At2L:7JZoQrbTFZY1iapZ3IIIk2KqnaD2t3h

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2