Extracted

• • Target

    eac22d03f15cca418159a37e8cbb0a79_JaffaCakes118

  • Size

    337KB

  • MD5

    eac22d03f15cca418159a37e8cbb0a79

  • SHA1

    750877d22f086439cc821e065674f4a38b1845f1

  • SHA256

    a202c16c429bd94f28e654fe03358314981747df85d3183dd5067706c22f0e58

  • SHA512

    635799c91d6500853ab4d6288940268ed30d89d46373ec49dfc46017e8201871436c32202c109fad48fe2affbc2ed87dce136e47ba7401a76eeb4f761e90732e

  • SSDEEP

    6144:jOpslFlqRv692NhdBCkWYxuukP1pjSKSNVkq/MVJbZ:jwsl8vg2NTBd47GLRMTbZ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2