Extracted

• • Target

    fd3ddc4322ba1036e8f11dfbfef159ac_JaffaCakes118

  • Size

    2.4MB

  • MD5

    fd3ddc4322ba1036e8f11dfbfef159ac

  • SHA1

    3a8a583bee0d356bc2b7660716766b6e42185c77

  • SHA256

    d7e5d3b79f749464772fea59b87534aeab50e3e9052b1e759e217cc278cbfe37

  • SHA512

    26c76eb887a4f20bb6a70591b1fe1dfa5963ab706c609c54054d3122fd4ff4fdaff80e00e857f22ad9a2832b185006153ee2f39c5fec8c0f1b0ae7ce306d2e3c

  • SSDEEP

    49152:JogMaPY8wbT6ZWAwBlFdurghTBZ6aww3NxEhxv:JX1XZWAwBVurQPwUNxEnv

  Score

  10^/10

  cybergateironmandiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2