Extracted

• • Target

    JaffaCakes118_525b35344dc846cb99de91509b0bf70f

  • Size

    559KB

  • MD5

    525b35344dc846cb99de91509b0bf70f

  • SHA1

    827333d79e6f5b9098a7827bd167febf38aab066

  • SHA256

    049cd4bdb939ebf7dbafdde5fcb31e7fe25aff94bbd7bd2a18c542204f3f199d

  • SHA512

    5ebeae1407f5b106152ef90a503e52d8ac49febaabbe534b0c88513ac30d091fb4688d05986e9f2d707a6cd9b76d410058dca049e43428302a2f9d6bff12db35

  • SSDEEP

    12288:BiRy8Eqayyb470SfvjfhnbVLigb/5HtfIXjKBPnyhUpo/gwJ:BiM89a3470SrZdX/5NfI+BPnyhUpOgq

  Score

  10^/10

  cybergatexxxdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2