Extracted

Extracted

• • Target

    3a449021339adf20a8aca968b7749150_JaffaCakes118

  • Size

    271KB

  • MD5

    3a449021339adf20a8aca968b7749150

  • SHA1

    753e33bb207056a210032be26b15993306b61bea

  • SHA256

    f84bd0e636e4340679b3ccc6e5cfc8c43bf2033b9788c7c33d973540d4a317f1

  • SHA512

    d7671ed7cf98bf59f47f7b19cb27483be5ceb3eeb16c5cecd9730061b7d4da3ff0f3b5feea5a03831fc83fece2ee0e72dc0af9cdbb1070deec5eb5f58fbf320f

  • SSDEEP

    6144:gMmr2GpGQU4CJebOF7DBR+eftyunRV6MwA8:gbqGpp3YvXDniM

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2