Extracted

• • Target

    JaffaCakes118_4ff022ad50b8e228dc43ae52f7c6a4f2

  • Size

    304KB

  • MD5

    4ff022ad50b8e228dc43ae52f7c6a4f2

  • SHA1

    be6196a7c0c639e04d571f7ab64219f480a56192

  • SHA256

    f553395154d0efacbe9e2533eadd2de66168caf36b4ca9b3f8e0e083da762352

  • SHA512

    b187f2efd64115c5e25b34d7cf8496de150bce4cec799ce81295655e0e9503ae32634d027ce5e55889c3c5d83ff0d6c7a016a4f1c96f078b8f8c693e846e39b4

  • SSDEEP

    6144:iMe4Azrg9vMzojIYXBpyaSq3PF0o+EZ7PhvF9zHKnvUPd:iZ4nvUokYXLnSq3PF0ozZF9zHKvO

  Score

  10^/10

  cybergate2011discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2