Extracted

• • Target

    JaffaCakes118_10c720ba829f5f3aaf637a0561ec1470

  • Size

    376KB

  • MD5

    10c720ba829f5f3aaf637a0561ec1470

  • SHA1

    73f90fbb7558870b127b0d9fa6ffd84c38c87c77

  • SHA256

    4359801215cc30164344fb3a06ef46d769a84434557ed153a03cf31d971e28b8

  • SHA512

    86545669008f862cd4c6cb0c3fa997201497c75f0110fed64933ea967f63e01f3691ca4fe2acf192e8122f9dd3a978c36aafd3ae24d24d3e1c92ab0a42374d8f

  • SSDEEP

    6144:OZOJ/43j+DMIwIRKSNBqDGPhsLdo8lTNFR+rfSvbDicWG8WnGYHN2nX6qoZgTq:GOV4bBIRKSNBqisxPTDRkfS69WGFnqqc

  Score

  10^/10

  cybergate4040 n server - @@discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2