Extracted

• • Target

    JaffaCakes118_215abc5d8a92817245310b8adfc6b77e

  • Size

    575KB

  • MD5

    215abc5d8a92817245310b8adfc6b77e

  • SHA1

    93a496c7c840a27888b5cae6b5de202ce39bd390

  • SHA256

    46421a77a245b41e2cd8a2ccf3c3143b3838ac752064d557dedc5e31b72d8435

  • SHA512

    2bc1c186c07926fba3f78210ac8360de3c5ab5b5404e9763537c77852b86394edce90fa175b8fe5fc54b7ba79717e9d4455b335d4e3f0dc5fd8d2f8c2e8d7694

  • SSDEEP

    12288:kpU9b5pYXaiDwysiidgh6WZv52kOPzsKMrOfL5i5upLK/lJg33JLU:N9b43dJwPQzEAJCNU

  Score

  10^/10

  cybergatemeisterdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2