Extracted

• • Target

    JaffaCakes118_12546a6287bc59b1b10403a5829dab2c

  • Size

    928KB

  • MD5

    12546a6287bc59b1b10403a5829dab2c

  • SHA1

    991931830ab19c38dff163489c88b9704550ea0d

  • SHA256

    f436d23f8674d20e20d47d03d3feaf86b9bcd45a067133fd40fabae42618ec18

  • SHA512

    7e78c733c410b1850f36dc510ef6d2847798242d087e297a493dc6e1ecfc2894a9fba80f58f8ec35df67ef59268ab6ab6499c2bbbc65a409b88603be9f42f003

  • SSDEEP

    12288:kpkytXqIQ+8qbYM5sW9Exoy9UQ16tRE1lHKd67yMNGZZ:kp/X4qwy3xQ1WE1lHKd6+MNi

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2