Extracted

• • Target

    JaffaCakes118_ae4dff67038bb2e2bc53436a61d0fed7

  • Size

    577KB

  • MD5

    ae4dff67038bb2e2bc53436a61d0fed7

  • SHA1

    5b4463fa10a4bf943c2aeb31d1673f898230b909

  • SHA256

    2ea8383910f382f095db1827792b0c644582d8c92e936173ff35a7e97ba4ae57

  • SHA512

    074295fe3616ce6bd4c1e0f84482acc8943525cce6f981a058157628c6fc3cc4bfe6374e5180a5b8e8da2d2bd2d34586ce78b1e3f6b52572d6ad482f6f8ce28c

  • SSDEEP

    12288:QjkArEN249AyE/rbaMct4bO2/V+SrXBxVWQZu7f0BNuB09VubeKG:LFE//Tct4bOsfjBxZs7f2NvVubVG

  Score

  10^/10

  cybergatenovodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2