Extracted

• • Target

    89461d87bd26da0f8860f03eb708a844_JaffaCakes118

  • Size

    592KB

  • MD5

    89461d87bd26da0f8860f03eb708a844

  • SHA1

    7ea95caaaa12013b80aa8fb49749991ff2397c77

  • SHA256

    79d6acfcf9b70e57371c2b69f3d1cf81a2342f07ff2f69df1958164b0f572c57

  • SHA512

    d22a03a364c60da538017fe1eafed1ee281ffaecb0624202224493eed241e35ed5ff7daa14e6194e3a1e91c311cbe96f1f43097fd3db373723f4034c9f11403e

  • SSDEEP

    12288:39AU9DHXkRpXkb+XoPUvbE/4MqWH8qZlFzuscszqav2lrpcj+fqhEB6iG:quD8poPUzSqWdTFwEqtpCDq6

  Score

  10^/10

  cybergate0discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2