Extracted

• • Target

    JaffaCakes118_465b9bc7c3fe5a5a49aaa26403f08048

  • Size

    2.0MB

  • MD5

    465b9bc7c3fe5a5a49aaa26403f08048

  • SHA1

    ca96661f850d09e41ace00a2724abec5016e1f20

  • SHA256

    4cd48a889193c4e9c237afaa21a266605ee1ae1e16d2e9151cea6340c55af9d1

  • SHA512

    d102a72db09abccef4e0b4b64faceec7b52639fdc29cedad90150c1a7377d4dd90305690a1b51dba4080b523c973f47384316e62047c8e7e6054d21afc3a09f3

  • SSDEEP

    49152:+m5GzBSsdtuKtrFjUzuhb0J2WH+Xa4ue/Rwri2bzuK:TQzBSsdkKtr3moRvYuK

  Score

  10^/10

  cybergateapachdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2