Extracted

• • Target

    JaffaCakes118_0dbb116a43d5969f1f897f4f0103b924

  • Size

    394KB

  • MD5

    0dbb116a43d5969f1f897f4f0103b924

  • SHA1

    2386d16b104193f115f91d794ff01e68b9c6cfb6

  • SHA256

    4defaa009bec775363b8d8878e592f3928333674d2cbe667e0a279367d6b62a1

  • SHA512

    33532ad0239238ace06c6ad8c8a3f5236bb3b146816a0d72c85bdb68b91172ccaa12378e08f52eb2dc3745a658016a63fa142cf8ca591656c11d1b3191b59a46

  • SSDEEP

    6144:EofObpCHZOeujWbbFYa4LhzssyY4HTWXpJeMFTpcw2mtxgCy1KNT7DFzdGkFaIHx:E2Ob1HWbBYDhAs0AjRx+6tq1KJ7DFzr

  Score

  10^/10

  defense_evasiondiscoverypersistencecybergateakconsultstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2