Extracted

• • Target

    848c9bf91f695c6af28cadaa862140e1_JaffaCakes118

  • Size

    284KB

  • MD5

    848c9bf91f695c6af28cadaa862140e1

  • SHA1

    369b43275f03407c3d01e50ef4d30555488aee8e

  • SHA256

    2476f7b7ef5ad3c5c55b8f367d63875d1e3a3f402a7315e8071b9f4dd3566891

  • SHA512

    9852d61c378b500d349843125cc32f9c66634b934e7700389868a5c126a9863ced8c3f4f8af630bfd2a3af4e1adbf9ab9015767e810f0bc37376a91300dd4eea

  • SSDEEP

    6144:3k4qm4VgWSUQq0SHSVOBZ9SydFhekft7WNzDGvgreQ:U9wZbq0Sy0gWFxNWN2vgreQ

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  behavioral1behavioral2