Extracted

• • Target

    73c2e2cf1d807ca3fa40f9e361feee63_JaffaCakes118

  • Size

    310KB

  • MD5

    73c2e2cf1d807ca3fa40f9e361feee63

  • SHA1

    c071188d2ac6de2b4089823cc6fec42031b2d202

  • SHA256

    dcc25086fae78d6e0e7d9b166e684a7dfc1fec0619c4511002baff9889e965a4

  • SHA512

    786410f42178d27805580adc03446aab70cc037995b0ea731189be7334c4a630d1e8c5907d211497858b6af361f5ff64aa306726a3f06a246213c47e98a1c80e

  • SSDEEP

    6144:VMGtlbbxUBA4A4st2DlEmW93WobRosBNEijgxpMR2I/M+Iayw/j3jT:OGtlbFmA4stYlEXmWPBNHg9+lSw/jv

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2