Extracted

• • Target

    JaffaCakes118_2ba65fa81a65e5ac85b5c431da65a031

  • Size

    320KB

  • MD5

    2ba65fa81a65e5ac85b5c431da65a031

  • SHA1

    189138b82093ea158e194cb32ead64ae2d9c44c0

  • SHA256

    dc029165df8b41bcd4b8d31ea30c604fe45ea8c0924b424aec51d93e92299499

  • SHA512

    23df47e66bf3d5341f793d8e9f42bd10e9e51c8be3aa8a42bfab268c4c7f6e3ccce330997dd7839f43c6d51831cc0058e8c0f2b95964447cee0cbf4c2f9aade7

  • SSDEEP

    6144:oDh+lMlr5J8t12ER5RQAOwW+PkPNiBKjMuVOJups3RADP26eZ:qhIsmNXRQXwWXPN6+McOJu6ADPM

  Score

  10^/10

  cybergateyoutube_09.03.2011discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2