Extracted

• • Target

    53f0ed5f9e43474e706bac0f4cee3a2d_JaffaCakes118

  • Size

    542KB

  • MD5

    53f0ed5f9e43474e706bac0f4cee3a2d

  • SHA1

    01dc2278149efd3deac51d08747bdb88566a9660

  • SHA256

    a1b5162bd9bd6c3a7cd5364437ee6236843d1d4ab5e1484ce26c131128adb9d7

  • SHA512

    69c6a962d93127a5aaec737989d6a44f5a4bdb34b9fca4e4a5b943e2ddeac5a1d1909e4ab57d77c0b400ca73c6493fd4614fd6fe28f87881fb394c8777d52233

  • SSDEEP

    12288:I+uEhTDrv7r2bDmPn5WOstC6kGI8yxnUyeUdWBFS7:IyhSqkYgqn2UaM7

  Score

  10^/10

  cybergaterossdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2