Extracted

• • Target

    c1b8c09cd0ab75e5854c8f13f6769332_JaffaCakes118

  • Size

    612KB

  • MD5

    c1b8c09cd0ab75e5854c8f13f6769332

  • SHA1

    fd0fa5ca76bb00af1594f07ea9ff18b196f75d1d

  • SHA256

    fce97e3d82fb5258882d967b3db0c01a99027c2f35552c4062c4882074ebce87

  • SHA512

    65d0302ab089888d1697c8b1d5f602dacfc4c858b8de17eaf4a2c6f238449ed4c51c4119a3baeed662121ca21809638d9e2afcbc280f489091ff73f875827b04

  • SSDEEP

    12288:OGLE0kuGnESBT+8H9u6vRHO/UUCruWVz/:TMtnES48HPuWVz

  Score

  10^/10

  cybergatehackdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2