Extracted

• • Target

    be4550019bf5f1dc9d6fc2fd571af7fc_JaffaCakes118

  • Size

    1.2MB

  • MD5

    be4550019bf5f1dc9d6fc2fd571af7fc

  • SHA1

    cd4d0a642f6fa6b35f52cce605110105a959427a

  • SHA256

    2b6828eedf999d425d42e74a62906917acf84bc7159998e319d896d088c670f9

  • SHA512

    6ecb44e0bccd0e0fddbafa39a1c2d92ad333ad38b399445bf30db18b650b5e879a1f7897f4cc331cd145ec5ddb9b0bd4b9c675516be8678553fe9c76328a95f8

  • SSDEEP

    12288:s0RamvHx5fziWG82N0gBV6q07+3ro2jjAX5RH/sCSTxia/UECOYyQjtUAoGoFNxf:TMzm4E9i5lY6ZdG9MerNGZTbZ7+

  Score

  10^/10

  cybergate1337discoverypersistenceprivilege_escalationstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2