Extracted

• • Target

    83886bf19f61d6119600671e11d70255_JaffaCakes118

  • Size

    249KB

  • MD5

    83886bf19f61d6119600671e11d70255

  • SHA1

    82dc647c9e76530c473bc0dc0120d0a8a87d5aa4

  • SHA256

    e2114096caa81300ec6d98d5a9e3f97af2399d2c52e42db92c1c04ea017c4326

  • SHA512

    9e293babe38306b1acbfedfe6e69eb7ab2729d1e81f8638a2031af3c4828b2b437ed18fb4e9b45d6795cfa35722dcc1e7ab40162b086775d63c0121f0a640bdd

  • SSDEEP

    6144:/uy914aIPSxIT7oLb7Pa+RTN87BM/t7qygai:G9aIKgozRyu/9

  Score

  10^/10

  cybergatemiss-callerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2