Extracted

• • Target

    JaffaCakes118_209bc6ea58f3e5b2047ca6af3a08c6f2

  • Size

    3.8MB

  • MD5

    209bc6ea58f3e5b2047ca6af3a08c6f2

  • SHA1

    82bf3702a44a4cdd9e3c2d9a106050152bd2c3e7

  • SHA256

    5a655c33666f25970817744a1a02c6bb475faf40f51ae831d7c93d8f51861ae3

  • SHA512

    a64a57453f02ec2cf76e62e55998ea39cac86bb81ef6d591b31cdd37950815834897d56a70531e207170b80bb9f57c1b1da9f8c35e2f5e7a427684da7c9d0783

  • SSDEEP

    98304:Upa6XPwp8OuDP+IgqIbZ2sRxJYABAyIEPpcSGzICh:U4iPyTuz+IaV2sRnRB3IEPOsCh

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2