Extracted

• • Target

    65c7cd6162900b200a3cb0bdc89e2da7_JaffaCakes118

  • Size

    1.3MB

  • MD5

    65c7cd6162900b200a3cb0bdc89e2da7

  • SHA1

    49a204c308a28e3ac309e37b01c456c8eb88fcea

  • SHA256

    1816558484dea1ecd50672af68a09c57b1a6e444e80f31f8dd14a31c83fc1961

  • SHA512

    8c522eae076a80028ed5c619a0b95ec5ea40e72b79b76ba7a236f2c0dd1aba022fa60151a3bb179fd4eb60222e9b857aa76e996f76eed5909fe597ebb312c57d

  • SSDEEP

    24576:LrzEMD5bBiRERYPzJSdS7Hl8yvHxlRHSAu2EO3JZ1qQd05kKuMjaFewHT2:dkLPlCSTqyvXRHSX2N7q5Pja0wy

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2