Extracted

• • Target

    14844aefc81b3e439b725ca4fb29a9e8_JaffaCakes118

  • Size

    725KB

  • MD5

    14844aefc81b3e439b725ca4fb29a9e8

  • SHA1

    1e6c413d11c9c0cfd75a931d766da67e7d60797b

  • SHA256

    e8195060c0599039841b4bfab6398ea09d364a960ad5d2d474962c4eace6545c

  • SHA512

    0ee4b7b140f19adae3c3ce68333a48baa1dd75fc1a142219e9f301a2b1be5f1ed7ea9aebfe3fb3fd8afc84c5658abb178104b07ad5a0b19995898a333549b493

  • SSDEEP

    12288:vywcslrJY5feOkxT3tt86yoyDD9QusTYpeFenCqQ:vywptzT3tt86xy9Zp4mC

  Score

  10^/10

  cybergatebaloch123persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2