Extracted

• • Target

    29c9b946a74765d1cafc56fcb2341416_JaffaCakes118

  • Size

    392KB

  • MD5

    29c9b946a74765d1cafc56fcb2341416

  • SHA1

    0ef09cfd2f49304b0cb06f3acb54130ba56bedd0

  • SHA256

    a3b2f5829ec774048fc85bb8ad4c2af0005eaa1ebb5638346c5311dde9137693

  • SHA512

    0be1d4689d1037c3a43e20b45883322b3c55051d2fad59924d0b2ea105c362b112a1bea1da03f28ecc8f9254e68367a849e973667f3cda8b7ddb6539eb4cc14d

  • SSDEEP

    6144:sr9gtp2pu05Bo7qhZIIbirJgcLhPJ6WJjjUIRFK6EjIQgipPu:MA2pLB8qg3hPJ3JjIIe6EjI2Pu

  Score

  10^/10

  cybergateöíóåpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2