Extracted

• • Target

    JaffaCakes118_609eb1e3e52c3c6a79440b078737c083

  • Size

    319KB

  • MD5

    609eb1e3e52c3c6a79440b078737c083

  • SHA1

    569ce45fb86441a5f876a65ff6ba3e0148ff49c6

  • SHA256

    8761af21af1e8e3fc81dc09ca051283ffa9fb36e42700e21f6c4822a580b1387

  • SHA512

    60dce872db472548be8751e776066c4c65dc4721293830d2614410dfe48288d5f6d914ae457c868ac28f9e3c0a41a605df3d20ed66ae35a560525f41c43965b4

  • SSDEEP

    6144:fBToHsBa+Gn7QKKP5R+A2MwYfap8c5wAhRAwpGlCju0LgBSTp5n:fBT8ua5n7QKKPb+ACJ8cRRNjCI

  Score

  10^/10

  cybergatenew hack 2011 ( clean )aspackv2discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2