Extracted

• • Target

    4b4fdb3a6e3c574a102b52c6c3f95972_JaffaCakes118

  • Size

    286KB

  • MD5

    4b4fdb3a6e3c574a102b52c6c3f95972

  • SHA1

    a148ae06356602cc9880697666cc7ad19d085c05

  • SHA256

    43dc879e87c6ce203566a55bfa2a92d2eaa55a1302d6f36199580d830d1021f8

  • SHA512

    b488f5589fc718b6cab0c81d0b79dd01260649c68d2cad534c246d15e72d0b4bc4f6446df38da7f42439170b36372ff481e7ad92d4a0efa9f94bc97df9d56a93

  • SSDEEP

    6144:DAcD6sEwjF5JwmrpQsK3RD2uW70juJCJsCxCO:8cD6sBiZ2TkvaCxD

  Score

  10^/10

  cybergateïíô ìïíïpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2