Extracted

• • Target

    JaffaCakes118_b4943099fe4e83616bbdd720193c38c9

  • Size

    600KB

  • MD5

    b4943099fe4e83616bbdd720193c38c9

  • SHA1

    10bc9ec59435e1ca2293b6a2cea36d7a73b833f9

  • SHA256

    a7bab2f5ab3b534e3126cf8bdc66d10a1179764f9658377f2575daa4423cbd2d

  • SHA512

    9801dd6e09b8f4b523266fa333553d8314476877a70d10469a06d4afada3f8a34443790780b0e444504f303698eb403e34e3c76bbee4ac43213b6764956ac4db

  • SSDEEP

    6144:VooioLwSD3EEZeJu39lvMC5PQv1xL/YnWYovoRxZmACoyRvJlN2MvJ7Iw84EYQ9R:VDioLnyuNtsaWYlN6R52MFfMYQ9

  Score

  10^/10

  cybergatewinsharkdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1