Extracted

• • Target

    JaffaCakes118_6e1a55707e4a9d77f92aa4196e1ec3bf

  • Size

    1.3MB

  • MD5

    6e1a55707e4a9d77f92aa4196e1ec3bf

  • SHA1

    57fe7bbeae94ae50e75f8219fd9f83352a58ea6c

  • SHA256

    711c41811aba0bf2f9b962ff2759e17c4c071543a85a406a0dbd18bb7c2fb6a7

  • SHA512

    64b9dbd95266314b193e900b720ed1544b444c5775568cab85e6c01918c6db28d229da1a6cd1f8f27467dbeb2c99e7f564ae51f75e8c450043b52357a3f85ae7

  • SSDEEP

    3072:ObncMd0cif8p9ZyzMfxK/NLgVVCbMauSobRLz6sBWbqbyR4C9sGCX9XiwiQhPWhE:gO5WI+YH8wc1bntl0nQMPE

  Score

  10^/10

  cybergatea1discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2