Extracted

• • Target

    JaffaCakes118_24f09ad60e50a9c682abbbeac5dddeed

  • Size

    416KB

  • MD5

    24f09ad60e50a9c682abbbeac5dddeed

  • SHA1

    729aa3691e0f87059a1b13e7b1063e7760d85dfb

  • SHA256

    e3f0346a067350e3aaaa428b1a33902075f2dbba35fff7ed91ec7dbdda239baf

  • SHA512

    595ef37863e01eb82f786f85b4416c63ef229bd8104c8c94b85dc7a1e6f891a91391c24d91db818533884b8b453550365036bd510e8a715d40f9a28353d9ec78

  • SSDEEP

    12288:vucHb3JMbgmsiPhRgYeJhdFbWYpVP8foM6:vjqrsm1evbjpes

  Score

  10^/10

  cybergatesystemdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2