Extracted

• • Target

    JaffaCakes118_1a8d462a0b58b6b54faa0dbf6003f53d

  • Size

    325KB

  • MD5

    1a8d462a0b58b6b54faa0dbf6003f53d

  • SHA1

    6454f4ec6606b6f66d1a7a9bf968e1d281f6ee6a

  • SHA256

    652e8a27da32f820a9ec34d8e1a38f9e80d3a39f2a1e484a200806d2cca69d46

  • SHA512

    c6d4fd44e2c15d2e17b74082d3b76258d5e91962d508ca8ccde613ce1c776c03d98e194f7ccbb9d65282ff0c0580405a98203fef348e5e4569c1bc5ae3c9448c

  • SSDEEP

    6144:x3yLSw48Iifn01K6bcVEk0k4Buueohy0BC5Rjt8YLtxjenlKkegDZdg:4LSQIEnP6ME8ohDARJbLtxCug9dg

  Score

  10^/10

  cybergatevictimagdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2