Extracted

• • Target

    eab56692582d0b846d3a88894fe80b26_JaffaCakes118

  • Size

    702KB

  • MD5

    eab56692582d0b846d3a88894fe80b26

  • SHA1

    dcf87767d7e685deb91fd81e9d0b8e1d11a5e9f7

  • SHA256

    c7f3a566fb4f82e2b50142d76ab04f0c38e28821c4c13e8dd9e1a05858161694

  • SHA512

    4b3bfd554e4fcf94463a180519f6781ce869b1677048ef7799a13740489b3311665a0038df284ddc7011bc7052e733e97eb345c687f78c42ce67b9cd25e0d496

  • SSDEEP

    12288:UcD667Q4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQRr:UmLtwCc26uGi2VCHXSBzTaDMsAQR

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2