Extracted

• • Target

    ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118

  • Size

    904KB

  • MD5

    ea8c4603d1adfb55acdd4375d22d51c3

  • SHA1

    a7fe6b585b5aabd9356bcdf0261a8d4899382622

  • SHA256

    4f4bbd221400dfda9212f322c02953131d9fc3be871d5cc6b66a9b7d36e9ca26

  • SHA512

    2bea7a53d2831dcc02c121194fe42d19f8763f24626702f8d15e0166d6c30253884e1b7d4132da6eb6d9fc6d2d61d69d1f89d69682b3215e7c7f9a7244231394

  • SSDEEP

    12288:8iSC/HR9+JuJCyuclzQteK71R3ozUCrqhnilrVVRkC4GEzUjyfTEfrC1LZRel:FZ5xW3YBwyFknAyferC1L

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2