Extracted

• • Target

    JaffaCakes118_78e2b32b04c150d2deac63889e0abf50

  • Size

    655KB

  • MD5

    78e2b32b04c150d2deac63889e0abf50

  • SHA1

    c715cc6ec4d2891c07e5d77cdad807ddf59d0fc6

  • SHA256

    52200277c8ba3053b814d710099d3820d5005ca6a6e2ebdf781d137761cded08

  • SHA512

    7511b2a6db903bbfca553985dda739a7bbecabdbcbb0660a8038fbbfd89a2993392bdf15ddd4066cdd5a4b3c7b9617aa86c67ded2de090f6baa1ef8f77555c56

  • SSDEEP

    12288:TBMmKGnhDT+JlCraEFmgssC2m9cwx+qdTC6AkQ5yaT3Og642Y+Sfj:tMmnDC+rPnsG1F64tT3YX8j

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2