Extracted

• • Target

    aaf6eaed3fb0a9c2b69f90ac7324972d_JaffaCakes118

  • Size

    1.0MB

  • MD5

    aaf6eaed3fb0a9c2b69f90ac7324972d

  • SHA1

    8a56f31293c6ef745f2b055e643e35c48c3b9981

  • SHA256

    2caad8a20e03215efe83587220e19209268a83333c7d8c81b014e982c9d18809

  • SHA512

    e6dbc323875a00b773c7e675d7eae0f8d76d1ec0e75cc5918388341f699c97cb637b44ae5d4075a144772c587328ecb4e0d143672453fb570116f6420bdff0dc

  • SSDEEP

    24576:saHMv6CorjqnyC8xlD3N8mJGJFo7QLyl/:s1vqjdC8PD98miF8Qa

  Score

  10^/10

  cybergatevitimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2