Extracted

• • Target

    301b0ea527920a3a5a0a32957342f0e0_JaffaCakes118

  • Size

    388KB

  • MD5

    301b0ea527920a3a5a0a32957342f0e0

  • SHA1

    b3bc0ed456f4444d695a93ebf4aa0cbc96711df3

  • SHA256

    c2fc1390af38fe4ac26d340b7627b3b82fcdaa27a0890fc9b65a43510648bed6

  • SHA512

    a7859a2765ad5fb4afbabfcb3461f6537e71c933c785ae128b522e2ae20c90ed1431456f6a11c8fd95a469f88f2b57a5d9527aa7ae98b1d421737219a38cfdc7

  • SSDEEP

    12288:3hmn041gxanKXWQ/2JMIDiI2Vj4qQGPQZRK:Rmn04mxaKXWQ/2aIDiJVuU

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2