Extracted

• • Target

    JaffaCakes118_22ce6d157221b0d02edda5966b593385

  • Size

    325KB

  • MD5

    22ce6d157221b0d02edda5966b593385

  • SHA1

    b9557165d0fb733b6926bca0c86a4a9b302bfe42

  • SHA256

    c1acfc60ecad7685dcc1deae3c2ed2cfc5c205ec90f3a0dc4b3e3f575f3e685b

  • SHA512

    bd065a15dcb74a71737757f2a680f845e523865b9fec5b208b48dc8adf3961ecefc2fec06e0fe8ec532703277ff8c418bd9a612aacc145fe98ed057125d9d475

  • SSDEEP

    6144:8VFNtRVEIfdkB80V7rajKxUFvvsDxm6+nSKxu/NmWkWSEo7qwSdnD+u2Y:8VF3wB8ePajXvvslm6+nSKgldSNjSd++

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2