Extracted

• • Target

    JaffaCakes118_0c13ab3e1c2418f15220be858f38e73f

  • Size

    571KB

  • MD5

    0c13ab3e1c2418f15220be858f38e73f

  • SHA1

    9d8a0132b4d57789f1f26e33b6d320cc270ac78d

  • SHA256

    1b9c7a62a5a1db274f9f112888989ed4a30f300bf0062738cd7b28d9af3a1267

  • SHA512

    19f067db11dc9647fef459484efa30036385bc3f24e4f0d2f8d3a8ba2a92fdd5443a0e0f689034e75d7faf2feee78d141c32535cc4d608ef37d8e0c6525bed6f

  • SSDEEP

    12288:3BMmKGnhDT+JlChTjwk9TY4sGPXppmpLd6CNC2:xMmnDC+hTRhSGXqpwT2

  Score

  10^/10

  cybergateweapondiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2