Extracted

• • Target

    f4c3bcc52b9760e83a80bf4a7e24634b_JaffaCakes118

  • Size

    504KB

  • MD5

    f4c3bcc52b9760e83a80bf4a7e24634b

  • SHA1

    00d482c12945d119a7b50b319b8740b0da8bc519

  • SHA256

    2ceee7a7e5bd4bf5b434c955ec157b50f8eaa7d125fff9cb048a093b3e324290

  • SHA512

    7605941e89c315d5fe0698651644a74eca0469573fbaeaa5a7e0012b2a813c8722f85d2add3bbd5571360c349eb2afbe8a92b75b72052e14e512c241de712a1d

  • SSDEEP

    6144:9QhNn/UqgLbGQDw+EAxtu6LBzapCj38A3s4Bf6JBmbTzBOn2o/O4nFwb1m9ASDxw:9gqdfuBW8gBfQBkUg4nFw5QAxrFcea6

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2