Extracted

• • Target

    5c6426921419c7faaddc4d85cea7b685_JaffaCakes118

  • Size

    489KB

  • MD5

    5c6426921419c7faaddc4d85cea7b685

  • SHA1

    19556f5d288e215251e28ac1fe6c51d12ba5ab14

  • SHA256

    df7f2fd7d028c9ead64cca83f8716228c1aceb02d7f88c1ef974bbcab9807514

  • SHA512

    630e26b51d466b04a1510f66b312c164feedbd16970b1e4283e2a4c138cba90393f384d61992d31cf00b720e293467a48a8ae438315380a35f05a2ecb3630894

  • SSDEEP

    12288:s47scX9zdXt5FkUpeHPiXvKYfXtF0DvXZ55APu/K4t:vsK9JysGqiYovXRoun

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2