Extracted

• • Target

    8643fd98fd320030e215c3a882482f18_JaffaCakes118

  • Size

    264KB

  • MD5

    8643fd98fd320030e215c3a882482f18

  • SHA1

    9eb364006ee178e7f1e6f9daea2091760e78b7a9

  • SHA256

    442ff1bb55154dc404db6fc7d71039abf621bd41bd126b2641b3a0aa790c6b37

  • SHA512

    cfe446beb724a6869ad85624a703ca68e5886dd57a3df81804dba0b15f83293fa50793ab77307136f5bb8cf5f65d08664103649835f58497ff454eb2f020915d

  • SSDEEP

    6144:xkeVh1buWLik/BEqvm0Dv5WuoCtHvHk1F8LwpOp5q1aiyYby:mYh11ik/Bjvm0DDnHc1eMUj6zyUy

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2