Extracted

• • Target

    JaffaCakes118_3644bb79915bf05accbf2ddf4c29f6d4

  • Size

    789KB

  • MD5

    3644bb79915bf05accbf2ddf4c29f6d4

  • SHA1

    323177c0a89c21a5d4fc802b7da6bcfe5c377899

  • SHA256

    1278806e20d19e7080fa9ccc4be4bed3f5a430d5a3df2660076d4a97f85522a8

  • SHA512

    a2c78b1dfb84110db725489805b8a043f291bc4d984899fa29b265971e7f1b8810dbfed222b03bf3530405f129daebbf52ce0a6d4eb1420a3a6d84f93ec8c669

  • SSDEEP

    12288:nHLUMuiv9RgfSjAzRty749PvvGA5VMdzH0AW1o6SAWLijCkPORiAKs8YFnGv6:7tARcm3uUVMdzk1o6fJjP0jZvE6

  Score

  10^/10

  cybergatelastserverdiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2