Extracted

Extracted

• • Target

    9d92dd4efad0facd09aca54d034ec87e_JaffaCakes118

  • Size

    270KB

  • MD5

    9d92dd4efad0facd09aca54d034ec87e

  • SHA1

    4aa2c1235eaaa48e780c249a124836449b3f15a8

  • SHA256

    fc72b7ad6b84a975997f8b505011ebd7ac55405032b32647b5e610b3bb89b8fa

  • SHA512

    5cc1e079c921d06828e71c71b73ef96627d195647926bf92f9cc0aaf4c342c443d72d114d3562d80642fda165008610c0531ea3fad3266142aac5a38f2e6db2e

  • SSDEEP

    6144:eMJPasSMGdzxJRftKnsMGqmJgL5byD+YJ97I:eOasbwRssxZq5OD+O9

  Score

  10^/10

  cybergateletter youtubediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2