Extracted

• • Target

    2b24f22b6a5c8b82d26adf4dcf23db98_JaffaCakes118

  • Size

    280KB

  • MD5

    2b24f22b6a5c8b82d26adf4dcf23db98

  • SHA1

    5a4078b488aab89255558d37d45c0429f971cff3

  • SHA256

    8e2cb91cf0d315bd2a9a396a7b4988f34eac722ea3c1849c31c78a83a951475c

  • SHA512

    f911b5b0ae20f9f3e39c459e7d09ce651209ec6d3cf009d255c487b40e1c4cf5a6df4ae095471fa57d7f211d2999ed851d0e2532c115a1cbb1547b57a851d47e

  • SSDEEP

    6144:93bZ2sxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdw:lUeAtpVxagMU/plruchDofAPK

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  behavioral1behavioral2