Extracted

• • Target

    JaffaCakes118_1ebf6eb8fd89543f3b3231c821915c47

  • Size

    729KB

  • MD5

    1ebf6eb8fd89543f3b3231c821915c47

  • SHA1

    c00c42032cfcfb6db5d369bc24cf1c7215eaa56f

  • SHA256

    f5fae12610b63388f8631aee5c463ef657c435e680d48f3f120cafc45a021e49

  • SHA512

    0d4f470ca64be0f56f27e96af1f8961f5ac9b576f0522bcc2b6d4bcf0cdc43c82f829a895bc20202f41e4ac3fb8c1824502cea57d8c35e46af483ee8570ea3e4

  • SSDEEP

    12288:RzmQY5Z9NOV4k4SH07ddH7zPvoio2BdkS4AOUIyxF59gXgukjhKryt1hxP/cQzLR:s7xEV4u4d5Pvxo27NSUIk5KXBoxP/ckR

  Score

  10^/10

  cybergateh4mmaspackv2discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2