Extracted

• • Target

    734631d39cd61d37d7dcf8c28be289b0_JaffaCakes118

  • Size

    276KB

  • MD5

    734631d39cd61d37d7dcf8c28be289b0

  • SHA1

    0228e9c3be1e2e4cebec62dbdca9273dffc7ba25

  • SHA256

    af971c9bec5790da4dfc1dc3e57d27cf16f6355576732ffa662d407e8dcb658d

  • SHA512

    d853487ca7855d5d46edb7d5053501197a76020cc9e17a15fb9d21403e0d8d426a284f3637a71ce9c5b6bb7f3bba456e4b00e3cb8a8882656890b1e999f7432c

  • SSDEEP

    6144:vk4qm4Wzt1VdyGj0HkZZU61KFM5ze4pVX7sW2xQo8rKL42:c90Pdy0VpYM5dX7cQocO

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2