Extracted

• • Target

    d0230abf9c1c67e87dd29cc9156641af_JaffaCakes118

  • Size

    275KB

  • MD5

    d0230abf9c1c67e87dd29cc9156641af

  • SHA1

    324f18a6849dea61440dfd3b89764a95824de5b0

  • SHA256

    0720e46a863b97e0ac6356c01559e64084141b750a86da0d879e0d7ed108306e

  • SHA512

    c06d74b66ff82386f122f1aad5a19c7fad362290667c77a290e08715a3b1a0a0e687372ca63d4ca1d421970e0081dfaac9c817c7249347ca8663b0523b3ef4f2

  • SSDEEP

    6144:qMIpd/maczir1I+gJN356A0+viWpR7/BKuXMd:qbpdeacziNc569/Kp/BKuX

  Score

  10^/10

  cybergatevo lam ii =discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2