Extracted

• • Target

    95d45d3a3d35a8a5d88b456cce507b1e_JaffaCakes118

  • Size

    914KB

  • MD5

    95d45d3a3d35a8a5d88b456cce507b1e

  • SHA1

    bd3f45c576a787c7409f7ff99d32ea2f107efce6

  • SHA256

    10e19026d2915ab22ac866b1577f14179093b8f962f9921912698fa780b47fd4

  • SHA512

    2cef32971b8ec9265d2ea1bca99e06fc10ac5275b2d389754fc7c6d68b47691d03006e7f58ec3c289a8acb2d5c95693959ffcee4c7ebcdd0c6e94b91bcfc9929

  • SSDEEP

    24576:qCjo0Fnj6cjRL7GQdVCW8XMDZope7tfsutFOi0gH:Vld7FRxfj

  Score

  10^/10

  cybergategizmoodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2