Extracted

• • Target

    JaffaCakes118_10aa101ab45a8c00c81b3365829c6cc2

  • Size

    588KB

  • MD5

    10aa101ab45a8c00c81b3365829c6cc2

  • SHA1

    9efaa3aa541f4168e6ed08b5f1b3f5383d8aeadb

  • SHA256

    0b8264b521b37957ba1f3654514a36b96f3bebec93fbb346a5eeb607d823503c

  • SHA512

    aae94bb42e9d88672e1f5b7dd7ad2b15cd3b73805f34674bdb27f136621407c628e92b7c99cba0503db7ab64a67ef11f4347e1fc4f0b878f86b486aa66cad293

  • SSDEEP

    12288:nFwHuVIP9vZ3puE1cjl+9K8te0DFCCW5GJtmo0f5YmGpfFMPZN:nBVI1vZZuE166dtaCW5GJtmo0f5Ym4W

  Score

  10^/10

  cybergatekaramdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2