Extracted

• • Target

    0f8475f72a66d851a6db021986663f00_JaffaCakes118

  • Size

    392KB

  • MD5

    0f8475f72a66d851a6db021986663f00

  • SHA1

    e53d028967af7b83c1f659260a14bc9f6585cddc

  • SHA256

    212f3de7e3370e5007581cc707e4be4312d2e0087f11ea9439d299257da84b5e

  • SHA512

    f711ef710089e118929ae77284c76078eec95c227fee719650462b04e826cf3885fd322ff1779e9cbb3fa40dd1a84a0b1768ce46aca736e61d58590cbc5088f6

  • SSDEEP

    6144:Nm0ozD7YHDA1kzZJRVyJQh/Ds1TMxCVnGOFbbfCiCohnHPrG6Yna65OBZ744Z:naDcA1+5/KMuGOsiCohr1YnuBJhZ

  Score

  10^/10

  cybergateskypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2