Extracted

• • Target

    JaffaCakes118_4522d6a0d6ff52913b06b0830f472106

  • Size

    338KB

  • MD5

    4522d6a0d6ff52913b06b0830f472106

  • SHA1

    5cef1b5f503898312719df2974b2fe9c295437c0

  • SHA256

    01f97446ef5aeb7cce0410b7fee6f172e7a880bdf87cb5601768899334c7740d

  • SHA512

    f38883164305d95dbf6ae5ffbecd5920c37337349ab8b1c27828872e41c7014da71e75fcdbab9a62262257c334c8236f7674fb26b6361a602d2d6f5a02b58344

  • SSDEEP

    6144:Sq8UJtOX4/nGvCzXHG77zVMJkGrC5lXjvJWAmCXRMvOKwhhLKPn:u8OX4/nGvh5f8gXX4n

  Score

  10^/10

  cybergateimbecildiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2