Extracted

• • Target

    e19ccdcf19ce736fb9e3e19277faed28_JaffaCakes118

  • Size

    949KB

  • MD5

    e19ccdcf19ce736fb9e3e19277faed28

  • SHA1

    9234348f49dc2e01a1e23421a2a12e572a913f05

  • SHA256

    49924103323a82aab9b3d320d0001867b41c3c4a6149377673515bfeb1ebada7

  • SHA512

    4811fbedf4f623c8640bff38ce5316deb427a0ea208ffbffec360971d32d2202a451564ce91ad9597eeff933f1213239eaae6bc360294c64a40862acad73f751

  • SSDEEP

    12288:TnsKeLLw9d04ZKKSyFSzimJw8AnQqrh8kfR6VavxHMFHRTmh3uKbgaR+4Ed88lUr:sM3fKaX8u1l8Gtx6HFvGgY8EXEvGR

  Score

  10^/10

  cybergateusbdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2