Extracted

• • Target

    JaffaCakes118_827775a9ab2df93622d4ac9ab193c74a

  • Size

    512KB

  • MD5

    827775a9ab2df93622d4ac9ab193c74a

  • SHA1

    709015ad8fec7c743c6b294d084eedf0b95ce60a

  • SHA256

    21e0984f2e26d17185bc3e2a3e4aedaba26eb8d7a330de7ea6f0da6f4aceb03f

  • SHA512

    47cde73b8e25fb506784ba5ccca1d50628a97a1cfcfb586bd21c7a13e886e4ceca189c3bba541c97954442a8d9f6b4fcbd26a96e1a1cb907b04291c5f6c62fa9

  • SSDEEP

    12288:a/0CaWWA0U2H+O7XVF64Qon1zS07K1wuf:m0C7V0JV449NSyK1J

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2