Extracted

• • Target

    JaffaCakes118_b09b2924ac5a5c67fd765e54b8d0269c

  • Size

    800KB

  • MD5

    b09b2924ac5a5c67fd765e54b8d0269c

  • SHA1

    883fe020baa49254e2e1144c25c7d04db8d1457c

  • SHA256

    75da3067891e147c41894917acb325a5635520a4cd4e3e9c2c8a82ee03f11622

  • SHA512

    8ef1e2527baae77bce029d7986f00e023051956859d767f7eca0cae08598b3d1d884ea9b202e057b896432fa765630fe7ae486ef5b335c325d88b82856e22579

  • SSDEEP

    12288:0yaWMn4Ood60dblyFJVByRHm0lKhOcrcAOuKtbfehBmvXu:YcDSOHm0lKtOuKx5u

  Score

  10^/10

  cybergateremotedefense_evasiondiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1