Extracted

• • Target

    JaffaCakes118_2f84359b4d0eb12cc2a97b0293cb3967

  • Size

    552KB

  • MD5

    2f84359b4d0eb12cc2a97b0293cb3967

  • SHA1

    a7e3aa55210c3b789a4c48e9629fa77b0ac464ff

  • SHA256

    19d6f71964f64dc89c6c5c65a913f06cb10afdf1a83a75d552c99c2336b9cfff

  • SHA512

    3ad629733d1240b862e6fef680b97399daeacb2323fcccfe25c30a28f177b00f98aaa2c4d3c89db989d195bb93c1f5daddf85530c88ce04dd18376853c28584b

  • SSDEEP

    12288:x3IxwwrbId5fkt5+zjXoIlAc/iHd/UZ2zkPaCxb:xYxjbId5CgH7kBUZOklJ

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2