Extracted

• • Target

    JaffaCakes118_22dd2e99e330ddc44a43ad592d117716

  • Size

    511KB

  • MD5

    22dd2e99e330ddc44a43ad592d117716

  • SHA1

    067ddc62dff658ca0a2766e63230925d9ab290a8

  • SHA256

    4e0113854ec6798acf576f583870fdf09d4cb2bcf31c5cfcf726d337460bbdca

  • SHA512

    065643298b8afdeaf14c3f18599e4f044346b7128a98e67e32ce6c1d423d31e04bbe696b223393098d7995b53de074cebf968c04d1801acaeb4a35c4dd949bf6

  • SSDEEP

    12288:O1DYrzy7d6QBo6Gd7m7fojbUexgazSDrAoWIEu3yXMH:OdYscIo6B7+bpgwUAHIY8H

  Score

  10^/10

  cybergatewhat's updiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2