Extracted

• • Target

    JaffaCakes118_61e0bd84f4ef13f272ebfa8f62a5cd00

  • Size

    590KB

  • MD5

    61e0bd84f4ef13f272ebfa8f62a5cd00

  • SHA1

    ed52e9e7aac902792e1dff7dbe0eb97e97af1b7e

  • SHA256

    df0a6ff9574bb522ca340fd83a24cc096f1c3ea36b66097155862b71f4383c34

  • SHA512

    a4e141b6fbcd3b94609548afca95b74b627b9a72240db1f9d316ee4f3dd0b7652b8845f90a784c56a2f53c6ccfe5e424fd7fb3e791ef6e5e64caa38e99669686

  • SSDEEP

    12288:sK+mjEaYf03ys/hB8y+vSCfj/bn9r5kxpA82PW0aNWiyzE:sK+QEaiVs/hOyit9rUq82uqiyY

  Score

  10^/10

  cybergateexplorerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2