Extracted

• • Target

    JaffaCakes118_31efe60ea00052340c9f4c126ff7b8d4

  • Size

    377KB

  • MD5

    31efe60ea00052340c9f4c126ff7b8d4

  • SHA1

    2c8232d22c90288f1f1969268f9ad7e604d6ba54

  • SHA256

    0ea310af89fd54fe3d936055f445905f99f99945b40b47b18abd46b97a775235

  • SHA512

    2b8ed837249d19d0fbd0e83556c98d83a48f3e3eb749c384e16c998e1763d0f2791f03ceecd784b2cfa32ea05ee8b7141fa276a794406d2d9e07d17162242c35

  • SSDEEP

    6144:d0QBakNPXYKM/laheU0ojKm/AtpfQv1AcxL/zil9+tMl05P+kEoVXuB4+9vWPhmk:ecakpIbUh+oOmMpY9zL/zw9+tO05P+7s

  Score

  10^/10

  cybergateboivindiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2