Extracted

• • Target

    JaffaCakes118_6948711e809b9dc97d5e71ce3139a673

  • Size

    700KB

  • MD5

    6948711e809b9dc97d5e71ce3139a673

  • SHA1

    348a6ec08034dace0b49f82e14d620da9065655a

  • SHA256

    a6f709d1aa5d45c6d9a2cb94cba2e4d78d69106bb42cf89f097f417f94d8b160

  • SHA512

    22af531c29dd26c81f674db4be5041d7b3975c736e08722f6a5c8da37aa70c7bf5224b788fbb6a1499da2d53c476ce946fc21b913c165b8753b3607b1942b718

  • SSDEEP

    12288:y+p30lYixsfvDBAzK9rmts3SL6HnfXz6QZh3slUDOWbWTD7Wg:yiEbKDasN3NnfDv3sBWbWTD7Wg

  Score

  10^/10

  cybergateremotemicrosoftdiscoverypersistencephishingstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Detected potential entity reuse from brand MICROSOFT.

    phishingmicrosoft

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2