Extracted

• • Target

    JaffaCakes118_3204af0be76faa02f864e68568c16816

  • Size

    349KB

  • MD5

    3204af0be76faa02f864e68568c16816

  • SHA1

    80f115e5b90fe7099c21a578f29cd3fabdb4ed47

  • SHA256

    3c58a66c0efa4fd3beb1df2c0872f7bfb4722fcb50a478b70098f8bc8d1b2794

  • SHA512

    53d620e02b751a5ca1128714848752724026f39f032a04e96307732befd9ca6570d6f959483e8c0e80f088d9194212fe0f586348c4bffa7e8c385236da8392dc

  • SSDEEP

    6144:P87QRdi0Rjnb5VGwJ2qB1DwUgDKQbeZ8cqgur7rY0tJP0Y2Um:P8QiYFV12CSzDBOZqnr7kcJ8Y6

  Score

  10^/10

  cybergatevítimadefense_evasiondiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2