Extracted

• • Target

    JaffaCakes118_4d5854caf7a3e701f44a95ebfdc64745

  • Size

    1.1MB

  • MD5

    4d5854caf7a3e701f44a95ebfdc64745

  • SHA1

    1f346ec3dadd8b4e06b257cbc95c89b963514736

  • SHA256

    e61b4d9b3b89566635cb4b28ee284185c377ff5807aa46497f03e8747feddac1

  • SHA512

    371dcd2cd5782e23cf3e424b8845646fb3f47ca432b8c8125c64d7c061da69e8463a732fdb8521205cd0511af9df4d9628f3655af32b95d45cebdff095a863ae

  • SSDEEP

    24576:tRmJkcoQricOIQxiZY1iaQm2dVyou7UrFrsNrnWOZOkle:CJZoQrbTFZY1iaQ1VaUhrybWKOP

  Score

  10^/10

  cybergate24 septiembre 2013discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2