Extracted

• • Target

    JaffaCakes118_72724b80e9c579c7c1efeb41e2c5263a

  • Size

    380KB

  • MD5

    72724b80e9c579c7c1efeb41e2c5263a

  • SHA1

    d8ace2e21dceb34e9536fa7439506af48492dc29

  • SHA256

    4d7cb0ffe2799f490613078c05064559ca1996e32fe1f3875df954147a4d8c16

  • SHA512

    3456d0d870953e664741e30369abe09db61be5e1fa40b611f0e558cbb246197f018dcf4097eeb89239ee18a4162c1870478ab29696647c9643a3c3cd89889bae

  • SSDEEP

    6144:sfTXbTgoTZyxqg9neO89qeS134PBCFiro2p0tfGzcG6WyW75Ku8DIoM1D0mMwq:wzzpG/8MQvE2p0tfOcX1OZQR

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2