Extracted

• • Target

    JaffaCakes118_01c844cb7f3e0af78343be796ac51c4a

  • Size

    299KB

  • MD5

    01c844cb7f3e0af78343be796ac51c4a

  • SHA1

    b798196c2ea22fde9fd8c293f4612706af4e9f10

  • SHA256

    6c087d2612a3edd5c071171cee6b4c1a77e0c294da7bfda0877bc93ec5cd0504

  • SHA512

    26309c6e46423897d433bb3f992415331773f476dd2b36fc3cd214a1dc1aa061d63f56f1a7ec656808ddda244c332ea6964bbe7fe8575b40694416741c674133

  • SSDEEP

    6144:KcD3YXBZUuSrEJSirpM8PjhRvVg/8iUfSTeFFR9Uw9+IapMd:D7uZUJrEppMejhRdgEfSTKFRQpu

  Score

  10^/10

  cybergateactualizadodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2