Extracted

• • Target

    a7381c71b97441b178abadd50d3463eb_JaffaCakes118

  • Size

    429KB

  • MD5

    a7381c71b97441b178abadd50d3463eb

  • SHA1

    c2c38dbcb2842dd89ea2d93bd505fc60b06f85ea

  • SHA256

    a6e534baecc75c265c5a5ed2394485947cd571f431568ae8ff9f014ab6901153

  • SHA512

    8e560e09f99f16bad8511ca56aaba7221f49154d7655632a9339cf8f18525ef190f21cc3a205731cfbbbc155fa4f2f65f9eebf652125f9e24c893db1b0d50846

  • SSDEEP

    12288:zONZ56buQ6ypisAR5uAbnJh0No64ysFcdv:zOf5UR7A7tn0+6fsK

  Score

  10^/10

  cybergatedeathcalldiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2