Extracted

• • Target

    c15a6c57e82234475e01eb3fc931fe96_JaffaCakes118

  • Size

    296KB

  • MD5

    c15a6c57e82234475e01eb3fc931fe96

  • SHA1

    f677a8cfd0699ce94f1146202d4551786ae43af8

  • SHA256

    7fa9d49bbf4d2b9437210d185d0e59527a86429926ce5557f9a9e46909b5a3a9

  • SHA512

    219bd3057503b5505712a8da6b24c8594437c9c70d4d5caa770fcfd451a26e4df1d900df37999eefef2ea9b62cff69991795e48d58b75abe196212aac9d682bf

  • SSDEEP

    6144:POpslFlq3hdBCkWYxuukP1pjSKSNVkq/MVJbN:PwslGTBd47GLRMTbN

  Score

  10^/10

  cybergatesumdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2