Extracted

• • Target

    JaffaCakes118_b05b41601b7a352e7e05225a7c42ec7d

  • Size

    415KB

  • MD5

    b05b41601b7a352e7e05225a7c42ec7d

  • SHA1

    c3d228c8685cc89f0397765d0b360849a7d85c69

  • SHA256

    7619196e32e5989ff01cbf9b7afcba37f7af56057842d8ede9a8a5f3baa744e4

  • SHA512

    f7ba8caa5996dcf0b8861a3c8b5dc9f49d125f651bd8489f9699668a5924142b05fa2fc3e4d080bf4005099593eca95b74cb55d3568a23acfd85672db311580f

  • SSDEEP

    6144:k6+UeEQ63daVhwbuu6uztXzA0ikgsPiPwUlmN+maAeJK849S4980cfefUv9:x+UeEvDaHeD2WuW+maWD9S4980PfUl

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1