Extracted

• • Target

    4a033758cd42a234da7b1622d3e38520_JaffaCakes118

  • Size

    290KB

  • MD5

    4a033758cd42a234da7b1622d3e38520

  • SHA1

    27f6565c544b9767c585fe5e145fba468ecc7547

  • SHA256

    c31a46d55ba71bc10787d65c4e93aaf680575a9b64694e1d0ee25b269fe1c24f

  • SHA512

    440cfac883fc90fa34f3d884a05dd4b97145e393a6a0255e8886e475ffb38778bd51d0fcae1c8a78d690918c0970464d873d88a969d8718d97acfb6951039425

  • SSDEEP

    6144:wmcD66RRj45JGmrpQsK3RD2u270jupCJsCxCx:5cD663FZ2zkPaCxe

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2