Extracted

• • Target

    86479572ece2afd26853a991f176407d_JaffaCakes118

  • Size

    281KB

  • MD5

    86479572ece2afd26853a991f176407d

  • SHA1

    dcae4e520ea07b335005eb9f07cac11d72139aea

  • SHA256

    47cefc3582d1dc52829feff27c6115862703fe176da73f82924b5fb636dbf25d

  • SHA512

    d3aeecbd0a642243deee2dfa40b46182aa0879d66b0d7f647e3ffea9a837f61fd0e7aeb3d3df7abd6862d6bb4b2ee56c922936866b1b3cb2d476799f46810060

  • SSDEEP

    6144:uy+phLTwlTLfkixFUQKf3D7TnBAZ5qhbxz:r+pt0lYixsfvDBAzK9z

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2