Extracted

• • Target

    9c3b1db9655bd3cbd5078757eed97954_JaffaCakes118

  • Size

    905KB

  • MD5

    9c3b1db9655bd3cbd5078757eed97954

  • SHA1

    3ec7f5e1a262a2fd85de6f45c5a879f68183560e

  • SHA256

    ee2890da5b9b3588700e57fa3ec80b2424359e898744592a904d47a81b817df4

  • SHA512

    c219adadbe6d33640646b7cedbd10578af60d1a5144f7f27797940048c33ea821fa5c884bbc8463fc58e76458833f9e4c0423776d7c8cf278b090d6a2e8e6511

  • SSDEEP

    24576:NrHaFSIR/998CGPMAPnhq3cff16UTyPgPMXD:ZIQjPn9f1/vMz

  Score

  10^/10

  cybergatetylerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2