Extracted

• • Target

    44bc1069163a24c7436cf35a93bba611_JaffaCakes118

  • Size

    274KB

  • MD5

    44bc1069163a24c7436cf35a93bba611

  • SHA1

    afe484069c1fbebb0af9bec7d8f70955ecbe8f40

  • SHA256

    f57d303321f8d5429e757128e4eaadbf07d0081257ad3e4fa85dede1202a28a9

  • SHA512

    2bc1da13760a5c60e18761bb88bb9455d37eed0e3c87e67bc83a4cf2c9af7f0d0f4017f863b06d35c6ec64ec404b010d216c3967fc67f39020664febdb9c66c2

  • SSDEEP

    6144:nMIpu9NhNyEYw48acZccSU+U4pN/EHqGs:nbpSbNrjbSUdk/DG

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2