Extracted

• • Target

    eaa28310118367b76498db04189156fa_JaffaCakes118

  • Size

    401KB

  • MD5

    eaa28310118367b76498db04189156fa

  • SHA1

    0a042b06f5eb82ae9524d5251a60d1f64f5ff729

  • SHA256

    0fc744eb12084f04f84aed9a3a5ca86a315dc3a72d03003b48162bbb67402359

  • SHA512

    5b80f08ac33265fad6b5547127fb66cd827db276346c06b47563e5c95b57cb187ca35dc413f4f2e20122dbc48d0c0dabb174c21277b65d2e1abad2f246169a87

  • SSDEEP

    6144:HOpslWYUvhdBCkWYxuukP1pjSKSNVkq/MVJbUIAqpU:HwslWYUvTBd47GLRMTb3pU

  Score

  10^/10

  cybergatehackz0rdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2