Extracted

• • Target

    JaffaCakes118_10201be6358827f2e24be3cb10e3e7f5

  • Size

    394KB

  • MD5

    10201be6358827f2e24be3cb10e3e7f5

  • SHA1

    a6fe399f98a78a9622804989991174359165d741

  • SHA256

    4a9ce9ea8fed254fbaab6af0700d2ac7c309967905dbeaa861866a0ea66fca59

  • SHA512

    88d8efc828ad61c150551e4ad3722b31116f3f6dff6117063c160914be53a8c404a3697fec077922859ec897b0f5c4cb02b683732eb541502d0a6ea732c5f8dd

  • SSDEEP

    12288:63LcNk0V1NpW/h/YMyB/2+MZF8Woh+pzRu2uXC:67c3DW/hwZ/QFtY6t6C

  Score

  10^/10

  cybergatekurbandiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2