Extracted

• • Target

    JaffaCakes118_14063e0f1d09f42e1056eb1ab35db1f0

  • Size

    317KB

  • MD5

    14063e0f1d09f42e1056eb1ab35db1f0

  • SHA1

    d05fc793bcc9ced0511f9f8d2b7df9a4eaac0b72

  • SHA256

    2f322edb726e47ab2ed0498a1b8688adc7aaef3555ef8d53be895f2bfe1ed4a4

  • SHA512

    51eaacc969ff5df54585aa22e8c11491b671c99eb26c4cfed1cbabd1eda8e46ee7e87e0627ba5f118dbd848c46ca4cae1c4cda731fab4e3a8fd4a5e557758773

  • SSDEEP

    6144:3k4qmJeRRnSx3LMCdjyqsPe6L2CCD3SGQh8oVRzjta+:U9UbhdjGeF32Zzjta+

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2