Extracted

• • Target

    ff2979128bd415b5442f0bfae55ef472_JaffaCakes118

  • Size

    302KB

  • MD5

    ff2979128bd415b5442f0bfae55ef472

  • SHA1

    b58810c85c1094a5c151195de35a323f51839603

  • SHA256

    eebdd2f9accda6e6c28bb1b6736f4b45171c59aa6e758b2a102372079a3a8668

  • SHA512

    e1e83dea09076f5f8e4a56ce1275ccf97d811a8f0da3cfc65f5436821f1dd4c08facf99078f4ab68cab73f60099a2b2dcaa319992dbc54d6cad0660a603e3692

  • SSDEEP

    6144:+EH3dI1nX37FsuXe8BhWitocSoP08ke4FuY8Lblb8BC1gcb2b0/3/Y:X3iRX35zXe8r9SC/kKR5QBC1gU3Y

  Score

  10^/10

  cybergatenextdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2