Extracted

• • Target

    JaffaCakes118_1d6ed3c17b19e631756f7ef4f2dc83ea

  • Size

    916KB

  • MD5

    1d6ed3c17b19e631756f7ef4f2dc83ea

  • SHA1

    4c321977743ce11212cf84b233d1e5ebdc899d5a

  • SHA256

    72e7b85cca162567ef13c20a66092e801047a7f223ceba6c6e809bd69780fde0

  • SHA512

    fc37e289b3fa40f6843f62bca29e2b56c08f85affb4e7cd7f5c6004b760b7ab0054671db2fcbf47da3a6d66e7735d07416fbd1fbc698c716f0bccdeb0a55940a

  • SSDEEP

    24576:JYcFMJLhVPZByLCbf5dlYJOrYV25r3GExmbsc3zLO6:JYvjPiLCbf/logr3asC/z

  Score

  10^/10

  cybergatesfx engenharia para minas k sfx engenharia para minas k discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2