Extracted

• • Target

    JaffaCakes118_a7f4b80020aeb7b9520a14d71db373fd

  • Size

    854KB

  • MD5

    a7f4b80020aeb7b9520a14d71db373fd

  • SHA1

    66d1f6d50510940ba6f3e16360df402300db2d88

  • SHA256

    7756fa478a5463d5abca6d3989c2c4251446803dc4ed1b0a9f69e60358f966cb

  • SHA512

    4e5b2a2ca18e3800c7681f80639955a017c3312e7f612880007f72e8603b24bbaa6fb4df5ecbc7503227ca99a795915dc8a89e141f2e87716e2a202f56dccdea

  • SSDEEP

    12288:ljeMYfumEQVCZ+03R7LpjR1qGd+N0+j6HurTik77nGJQWMpnXxcq029iA:lhNPj1pjR1qGN+j6G+OSe5pnXxb029

  Score

  10^/10

  cybergatedreitovicsdiscoveryevasionpersistenceprivilege_escalationstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • UAC bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2