Extracted

• • Target

    JaffaCakes118_4f6826c94eff4fc0fda878ba1db4400a

  • Size

    436KB

  • MD5

    4f6826c94eff4fc0fda878ba1db4400a

  • SHA1

    04e465f7a4a2a7f65372199a35c3a3ce3440fd13

  • SHA256

    19cfe0eea046eb90a600369dc457305128f7b33c1850cd19042499164cd9a460

  • SHA512

    882eb5c005bf3543d5c37d39554a403379d67c48f20cac965f9dbe227d8fadd14a1b5ee7d46f76dd17db7e55860c3a732baaaf6cc0293f1f627893899a97c74b

  • SSDEEP

    12288:UJJswDfwh0eTTJnBhL3/8r+CxIyN9m1pvfDIfvl3wF:mawPeTTJnB10r+CxIY9mL3DIfv

  Score

  10^/10

  cybergatevítimadiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2