Extracted

• • Target

    JaffaCakes118_7b4869526fc017465c04ee08ef89952a

  • Size

    497KB

  • MD5

    7b4869526fc017465c04ee08ef89952a

  • SHA1

    5a94d7c2eed8152be65c4fc49b6c08ae3ef1dfd2

  • SHA256

    6702ffbdd42c6b9acefb0a6cf6abc0790edbc9f81c946d1bb04d26c13d258452

  • SHA512

    d1317b4cb36da635898ea22176384bc50d2d60f8ffc28550c5b633061dddbc110bbb6238e6e0424aaf37bd7c01c21fec1944fb7119a53f408b16118fb937286e

  • SSDEEP

    12288:mxk/1iVUt5Ly7Gc4d17Akz74AexLotAJ5aKKow:mWdi6fy7Gc4YCMAJtW7Ko

  Score

  10^/10

  cybergatelightdiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2