Extracted

• • Target

    3b61de5191d7f324b4614426caf177ca_JaffaCakes118

  • Size

    808KB

  • MD5

    3b61de5191d7f324b4614426caf177ca

  • SHA1

    9e843b3c015d42d55c13113fca21d3dbebba0bd5

  • SHA256

    84ab545b3a7e6c5c835d78fd7e266aee63e5a9b9bcf07c5034210a153a05a117

  • SHA512

    aff1bbfd691a520fb9931386da5a05320b74a715bc77c73603dec6adba2414c40d1d761c067e1cd4be9560d43c3cd9d267ca3141e14a37ef10531d3a148ccccd

  • SSDEEP

    12288:F32bfiKQUP4beuuOQZ3nfqPTSotfafiz3BmIaEUaJFFt0Mm7Q0voNux9B8:C5BI70hQ0bx

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2