Extracted

• • Target

    JaffaCakes118_621c9d5a5c1dfb69b48d2e445eed19fb

  • Size

    1.0MB

  • MD5

    621c9d5a5c1dfb69b48d2e445eed19fb

  • SHA1

    61f0a8b4c744bc6f6ccb92c2a9ab76d668f6c689

  • SHA256

    e57dcc9e839d1ceeae5e9433428e695464d7d9faef71f64d7e55a42b40047394

  • SHA512

    25a2c301de14bff222e9564ee7e875ccdce7d732d9e7d6da855fb51802eb9c0fafa1f8eb8d1407d677b444610b11a9512af713ba5b0f7d1e531dd2fee2d2942e

  • SSDEEP

    24576:QVC21qZUAtLuRSN6LXsKti5NDFL5m6W/FqIFeHR:MqZU+Lm+6LcKutm6W/lFeHR

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2