Extracted

• • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.3f2045fc999cf3274cda1587a4a96bf0
  • Size 977KB
  • SHA256 16726a5322f5b86db8fe6c0a5d510b20db3deae2009e7374bba6854133174b55
  • MD5 3f2045fc999cf3274cda1587a4a96bf0
  • SHA1 7956255cec6072a4faaa06e7853bb810335d74e3
  • SHA512 ecb1feeb839aa393088386dc965eeb6566fde7121307c09192f15c6b703b4fcb6e81c7cca4ddd62d12817773b835b8c33c86e72245aa44c15e33b928a3211977
  • SSDEEP 24576:z1dlZo5u3kGOqy2zuL9a6Wz6ZgRJWkiERxU9TUQ0:z1dlZoekWUL9fW2uVU9TUQ0
  • TLSH
    T13B2523A4C0D214BAD82AA4795F61CB343F749F161A1EC90293E9FD5F8C7EA57B709308
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackuseddiscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2