Extracted

• • Target

    8d0f2e986f4353c932ee1323682e3781_JaffaCakes118

  • Size

    540KB

  • MD5

    8d0f2e986f4353c932ee1323682e3781

  • SHA1

    612e366beae729b54812014ce91c582c8ef3b182

  • SHA256

    f4abb079013fdaba71e4a9ae91830b1eaab94e37b29670b28adce9372b7cec23

  • SHA512

    61cdf3e2ec0172b6f403ec8c147658038c5911e5d251785fe3e0e1e4ba428f936dc6e81312308e2adabd7309a513642cab188fb9d2f8888acb9a6002c1922449

  • SSDEEP

    12288:Pz5uLooUUJTgwNgdRfMbIwDZeW8/siD5hDF8k4PBV:PzILooUjfMbIwIW8UiDrF8k4BV

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2