Extracted

• • Target

    e2805cfff9fffd24e6abdfce3643afad_JaffaCakes118

  • Size

    384KB

  • MD5

    e2805cfff9fffd24e6abdfce3643afad

  • SHA1

    41dfe280ebe57e14ff895a7e840b6f81ef6e78fa

  • SHA256

    b21ec2cfa8df0939c00e000b35e659c8e9f332ed29f190be6ba116f5396b5679

  • SHA512

    426940b2d73716a6c93e8f5ae82e947e5ba538048e9dffcd5e3cb399888a7ecbac5bd305fe1d1fde1bb3b2c8681cd35af4e2bd5303f3a70d2f2ff4abc2768fad

  • SSDEEP

    6144:E4ABF94PpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKjhTyfVDoTC/kNXLq:bUdGLE0kuGnESBRy9olq

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2