Extracted

• • Target

    f43e066d496dcddade45772932f136eb_JaffaCakes118

  • Size

    1.2MB

  • MD5

    f43e066d496dcddade45772932f136eb

  • SHA1

    37b27bd2ffb407cd8b9f245e6c821a528daf6867

  • SHA256

    f6ca5aa8602510b15c152622c0e8c240cc52d7adcc5cb5cb1511b5d3bb4034ff

  • SHA512

    c89dccbff95917dfac447c791948461e04e0afec572adb76b42139013713456f5a5e74aac55511e750f4dc4adad28ec184f978566e9a6526f485825185643b7b

  • SSDEEP

    24576:5K4dbZ6+o36UsqjKXKBUpjhek8EXEvGj8EXEvGt:VpO6UdjKey8E6GIE6Gt

  Score

  10^/10

  cybergateusbdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2