Extracted

• • Target

    JaffaCakes118_01ebc7d1d7a3e9ba43d98863449432f2

  • Size

    644KB

  • MD5

    01ebc7d1d7a3e9ba43d98863449432f2

  • SHA1

    59059f24d5a416a06f7976508688416ae38a6f50

  • SHA256

    e36f4ee428c9abded8a7fa59bdd11f7341cc1211c73fce5069d3d7eaa66f7676

  • SHA512

    8776f3f3c9c1469db8bd37871e7d0fb8688255c57f58c72b550dd2742968db11c52b8550ae3209a788fd6ed5c354f21b68098e3a219df293b7781a5bf2c54c9e

  • SSDEEP

    12288:cFumuLM+DqWaSMB9KIAG2ruBeIvjgZVJKfDYQ3QxNKYFm:cFaY+DqWaSMB9KrrgPQVUEQ3QPKYF

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2