Extracted

• • Target

    6c708bfc7853068e9014149bba2687cd_JaffaCakes118

  • Size

    492KB

  • MD5

    6c708bfc7853068e9014149bba2687cd

  • SHA1

    56a622ef12b13431c970b54f695c71c6148a6fe0

  • SHA256

    ac8696412e90f09be9cfb4d74c350629968257f04d96cecb2cd736973535bd5c

  • SHA512

    61e3d82e3ad8c16e1f7d3b052be2b919c9ef137de20623fe1aedb1e502641a22e7aede127b1a98027522e2915be24211db9960ab86f0493c3b1a7dec8afb3f29

  • SSDEEP

    12288:s47scvxAfZyx9+AQkw1uYJB0xGNiBpoEc6XpYauR:vsgn+ApxUW2t

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2