Extracted

• • Target

    dde2a986d062a0564e4dc79f5857c069_JaffaCakes118

  • Size

    1.1MB

  • MD5

    dde2a986d062a0564e4dc79f5857c069

  • SHA1

    fec8a8f6280e82065178fe315c96c114fb77c08c

  • SHA256

    50dd202c8d4d81e03189f45d755c7a89a485ccfe4b919a8e2f05fa8b7edf569f

  • SHA512

    5d67aadb9dc59d7b80719f328a8039d8bf45f9858fee642013e34cfee413f15cf72ee644f00f0df1a8873f3435a4019b4fc243a1d47c491d69e55fad9afbc25f

  • SSDEEP

    12288:Ws+AMoSI/vj/d+7MY6oIB20hoEsA1sxpVqROc4TqMmqqyClksXmQVRNMe4af5a23:W6+I/vzM6Jp+VrqROk3qOlnMif5aSMF

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2