Extracted

• • Target

    9b60d180a7bece9556edfabb76894f94_JaffaCakes118

  • Size

    432KB

  • MD5

    9b60d180a7bece9556edfabb76894f94

  • SHA1

    dfcea92ce9b752f3e6428bb7c99b554828db8fe0

  • SHA256

    d22e161742ed0f1593641893e2ca55fafc7385e479f753907721f167b5599adb

  • SHA512

    bd2725818e7c08d9bb12eb66c2e2d1fa57c4044227bf4dd207530a88701d604bb8d33db5be3460351bea42132b5da4cf50b736c8beef0ce160ab6bb8a80322b6

  • SSDEEP

    12288:5zy6rRxEBusPWNZhwRFUsK8oiWTDPY5oa7P1:E6rTYFWNsPUsn9ODPIoa7P1

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupxevasion

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2