Extracted

• • Target

    ebf2a095b4b0b731f34c4cc0819c8280_JaffaCakes118

  • Size

    165KB

  • MD5

    ebf2a095b4b0b731f34c4cc0819c8280

  • SHA1

    63f181cbbc2b584f2cd5e6ad32a932ab8f0d9738

  • SHA256

    12326f5a13c3d4bb6145a3a401da353ddc0260ddb2d2b72e1ad15a1c9ce4914a

  • SHA512

    b0097f4ce2f745f8677fc02887803e95683d6fac60f1415fdf86ec33ca21ebc8aa51c041458be210aba2bf3a6fa0bcc56fe1e5a77e4f8bd755c9bf59c33be082

  • SSDEEP

    3072:XUWznoRdUbeItPPjtq0svSa51sH4fUlknOF1d2sjca4v:XtydUbeICYa51ilkODd2sjh4v

  Score

  10^/10

  cybergater'séïïßö÷»údiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2