Extracted

• • Target

    9c8a51cb4d779dc24989313c6fe6f93f_JaffaCakes118

  • Size

    808KB

  • MD5

    9c8a51cb4d779dc24989313c6fe6f93f

  • SHA1

    5a13e58224c236ae8f9cc388bea00f7857e07314

  • SHA256

    b217b5ea2241fd7e935b1338c125dbb065d3aa4fcc8dbea51caf8d21f03ffe9a

  • SHA512

    96fa838c89a384ec053bed623a890c8f34af0123c52b3aa4358d55aeeb4fbd9b6dc88f332a2251a18ccf5d7fd73807a2c71f69d80a23f50c3278365d3b483415

  • SSDEEP

    12288:IjB29iPCJmRdkR2ys5zUEM+G6Er2GafBWs7K4dDEtWqPHhFFPVW+JiVu+bCI3ZXQ:IsiOVmzBI2LKWq5rPZ6u+bCI3ca4

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2