Extracted

• • Target

    JaffaCakes118_b8eb7c1ec537099534c4857911d1ed51

  • Size

    973KB

  • MD5

    b8eb7c1ec537099534c4857911d1ed51

  • SHA1

    8932cde87c19bbe28a87390ce7cbd2c738308da4

  • SHA256

    952bb65d3362da5dd06154d694876c4864269a756ca60aaa287d042909672dca

  • SHA512

    8121e6d8abfa2eab51a641bed648858a59331189fe9266c785468c9f5fa9b17068fe505c4b760d26d87e4ab6903d4da90215d0bbd0b92bcb92ced6e665d67733

  • SSDEEP

    24576:gC24TcYd3REmarat06Z2a2pyJ0Y7VM70ERxA8vryN5:g2d3Rora26Zd2pm0YZg0K12N5

  Score

  10^/10

  cybergateaccess222defense_evasiondiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1