Extracted

• • Target

    4251977f6f5c4175482c0b37eddb8b8d_JaffaCakes118

  • Size

    276KB

  • MD5

    4251977f6f5c4175482c0b37eddb8b8d

  • SHA1

    88de6cc8ffc004b54a87354728234334534d7b45

  • SHA256

    e1a9622c7ebd99b8d01a5caa980787e92a66cbf25468ef950b7d8ecfe0e0f7b6

  • SHA512

    bc506aa4cfb7e549e24581a85eb413525f88b6bc9c62cb141d98c122fe9f859080df1d24869fe2120a119abd3e0335520b6ac0ba7da698b5bb71ec9b26d4f59d

  • SSDEEP

    6144:5k4qmioqIioDj3HySp/bdojxoH8T0GNxQafjjGje4JOb:e9BzoDTHyACY89QqweN

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2