Extracted

• • Target

    JaffaCakes118_15b50b26d92fb3c3def3b62b4c98608b

  • Size

    1.2MB

  • MD5

    15b50b26d92fb3c3def3b62b4c98608b

  • SHA1

    42a7dd163b434e63a4d31472fb53aa680afe6152

  • SHA256

    394e9a0d2694b04a11f6fbaf6cb217e33c43b1409411566c15b67cc0be192b8a

  • SHA512

    a71695fdcdaecb3a52969b25443430ffc9dc00bacca39aec98881e81840489d8642d3ceb527e370931bb4da0b29e9c8959a8005a88ef5ed6260c83d21f5f04b7

  • SSDEEP

    12288:9X1kccIQ5MyeQS8F3slQ7oQCp+CeQyAP+8wru7hdIK+Z7VCsHncwPwBFaqVHx0aN:nlcH3r7o3EzlMFblMRKj8dy82bq

  Score

  10^/10

  cybergaterunescapediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2