Extracted

• • Target

    JaffaCakes118_8715d5d32241ec20ab28776fc7f00608

  • Size

    988KB

  • MD5

    8715d5d32241ec20ab28776fc7f00608

  • SHA1

    eaa03250b7dd818a9b285138ab74604a21f8fa61

  • SHA256

    36019c7bc0dcf3dc1d8859868fcc2f8c1d6c60c800a4f8051912afe7591a9a64

  • SHA512

    151a423a2205736a5b4135778517498e52d751522ecd1ee03ac64aa5f3373e58d067819db90fb856e7d9f8c8f66e880f868a9a1d210452362e60de74a0cc5998

  • SSDEEP

    24576:AOi0Fw/oqfwUmPgkgciol49QHrBFszpFdPQ3Rg4PfSctpAV:A/0Fw/oqfwU3kgil4GozpFdPQ3lPfScO

  Score

  10^/10

  cybergatemuawayonlinediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2