Extracted

• • Target

    JaffaCakes118_219af94c3f253644d4a8b7530dc192b3

  • Size

    324KB

  • MD5

    219af94c3f253644d4a8b7530dc192b3

  • SHA1

    9418c8ca0f69c5aefc0ef6c805eeb5fdcfea68a7

  • SHA256

    4e9efa73472432a7d7f1f9629883103bc116747d0aefb7e28952df240570c22d

  • SHA512

    e20784a491e3e516ca82a3bb6953fd476b84e77f76e9874278c3c71169e60213b9bd34218b930c0a7820bfab9388a1b208257703ce9c12f7b9a880ec5faf4419

  • SSDEEP

    6144:WHC94TLJdO7hKW0DxkjN9scBOnbRkdnRUxmkhM1d1ty:BILJdO7p8AMdgmxP21d1ty

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2