Extracted

• • Target

    a0dcc83ec76f78c07bb5b7bb65bfc9c7_JaffaCakes118

  • Size

    320KB

  • MD5

    a0dcc83ec76f78c07bb5b7bb65bfc9c7

  • SHA1

    be3542aa112a774b66fcb28714dacd9ec5ae247c

  • SHA256

    a78baa07f46bc2a327a7d6394ffc027905db424dd98fc6b7207dcfa9023cfef2

  • SHA512

    784528452b24947d79ce5758bd3be56b86530fbc3e1b8bc956a011f2ec0ab956427ab82490b45122e3fb7425b11046c0985743cd47a3b651cb4cc37d379a7228

  • SSDEEP

    6144:L3LZXsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPd8:bReAtpVxagMU/plruchDofAPW

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2