Extracted

• • Target

    JaffaCakes118_1482d2fcf7f501480249f850d45f3869

  • Size

    947KB

  • MD5

    1482d2fcf7f501480249f850d45f3869

  • SHA1

    48678a7d9ccf6a6b396a6379b3c7850acc2fbced

  • SHA256

    3b20f083be3da2ffaf1ce2404f4c02a7984e86ec5aa700cbf76c6f3fc358b719

  • SHA512

    17cf9257145f92d71f2d2759a181771767c22867f6a17ae2b657ae26babc67fd4b972a53caaaf4592ef3344443bffa747385c9a27f463a134ce00584757f8f37

  • SSDEEP

    24576:9wQjsiK3jjPIPfadg3YDU0pThlAVqzCetgkbzeq:9lk3jjE4VZhCVqWetgkXeq

  Score

  10^/10

  cybergatemicrosoftdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2