Extracted

• • Target

    996780fd74c9bc2219239e38fa8516e5_JaffaCakes118

  • Size

    290KB

  • MD5

    996780fd74c9bc2219239e38fa8516e5

  • SHA1

    bc0632facadc428e8f8962f5669ce90c9cb59752

  • SHA256

    73a783bed653e7c0bcb6187b56d827ff7de191ac8c8a72914d6d94e1ae0e4fe6

  • SHA512

    b9105db8894fe8a1ac9848db9b51e95ba907adb91a08b7113a22f98236d212d64f534baa74b7aa58efb96f333fc72bc4d88ed74df7df4e6c3477f8fab65f72ca

  • SSDEEP

    6144:wmcD66RRj85JGmrpQsK3RD2u270jupCJsCxCB:5cD663ZZ2zkPaCxM

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2