Extracted

• • Target

    JaffaCakes118_76c936d7e1251a279e32504f7fe3f5e1

  • Size

    298KB

  • MD5

    76c936d7e1251a279e32504f7fe3f5e1

  • SHA1

    9f1d8d7704cf770880d01117379695b1656332f2

  • SHA256

    ffe6dad018f5bc0eb8e6234b121fa5ef25e09335053ea6aaec103814cac775e1

  • SHA512

    af4d3301a3becc8f13caab91e6e130edd839728fe835ee03d689f13f1804d1758243d5fe62dfdb702a0bca1799e0598f10f8cc7ca341c76d58944a4605174496

  • SSDEEP

    6144:wxJsGLnY5oxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZT:SJsGM54h/xQp6+tqOYy9zo0u

  Score

  10^/10

  cybergatelammerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2