Extracted

• • Target

    JaffaCakes118_1135ef2ee19c0af6dfa9f47c0e484943

  • Size

    996KB

  • MD5

    1135ef2ee19c0af6dfa9f47c0e484943

  • SHA1

    9c9f987e0f935185111f765e9392f21de25de9ce

  • SHA256

    0f4c6f890e574dd61007d46c9da41352bbf9e13d4b6032e9b1c2a527d0cebc1f

  • SHA512

    b73db84be8bd8a720a7646eb05bae64b8a4de2a83c9b5a9e19fbe28a8f2d2fc1dd4580afc1f24f71047573f89cb5c7611704a29b0c8245a831fe3bb886a7ef74

  • SSDEEP

    24576:2RmJkcoQricOIQxiZY1iavLldictwTpVJLVA:TJZoQrbTFZY1iaTldictU31e

  Score

  10^/10

  cybergatehackerbóidiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2