Extracted

• • Target

    7965d59f15980d749e028be65b07009a_JaffaCakes118

  • Size

    983KB

  • MD5

    7965d59f15980d749e028be65b07009a

  • SHA1

    160fb97ace53681fd863f899ddf4ea50c87410d8

  • SHA256

    fead6b12eadcd3d9c644424a7632e3bbecaffd5b3714c3e4804df8a28b7bd9a7

  • SHA512

    688f95222b1864d12433d0a9bc8084caeea348ea5c2722194dfc9c3f6498b17a279bbb7a4021b516ec7ea4504aa2c6a3ecee09e4fbf4f352f5ee8b99470d07df

  • SSDEEP

    24576:h3QONoM8+rCMBLEDrikdR5S5QKEYwx5SGZaoPtW6pk0/j:h3QOSM8+/tkdR5S5PEYe2D6h

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2