Extracted

• • Target

    JaffaCakes118_172349e8c8c93f656a860f941bd73643

  • Size

    3.1MB

  • MD5

    172349e8c8c93f656a860f941bd73643

  • SHA1

    9ecf36e3d6908a7ec7639969af28bc0e868b52fe

  • SHA256

    98cd5a9e6716072d57d0f94897f79ed1bd0648ff81f73348915f940363362d23

  • SHA512

    fb4c5704970020dde9b4a5f457feaef1d528187436ebfe60a933f891eb4301f88e803eb939734c4b87daf5820d2712287e6899b8fac24eaafe310e7a51d5df12

  • SSDEEP

    49152:3q9wrnk2mFGdI7ogeH/os6bqbVkys1KhdBcN/nra0uUWpf0XWlQ08EyU53Jc:Zrk2t9j/v6W5kyjbKNjVupGXW208C3W

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2