Extracted

• • Target

    JaffaCakes118_12935882b40b2095cf1cb9124557f992

  • Size

    831KB

  • MD5

    12935882b40b2095cf1cb9124557f992

  • SHA1

    75828ca8954063806746537816ec98713ea44510

  • SHA256

    32de0f5dcfe5816e386705c70ed597e7cd7532e218e2c79ff912f3b69b3b3bd1

  • SHA512

    2715a953ae4511d8117af2d11218868ed7fc5d59cbfb01cc55c46fe1978ab418f52c6ab2099bf8e08805ffda10c03060e08f85a2ae282f57e07623b571937000

  • SSDEEP

    12288:bWu+o63+b8vmxxSmNXYH7xDIcMEhC87GjwMEBaRaHe9/6o0iMWMdC8Xfj3:bWuexmfN+1DqEcjwMbo+dbvMPr

  Score

  10^/10

  cybergatei_am_backdiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2