Extracted

• • Target

    afafb399c91393a19603e9ae1b6d4f62_JaffaCakes118

  • Size

    478KB

  • MD5

    afafb399c91393a19603e9ae1b6d4f62

  • SHA1

    acfd15321e2c729df871bd7810f4e5484180ec42

  • SHA256

    fa3a0a50b03b5e4d4819620004cb7f03b9b3976e44e799727babdd2c2bbf8f53

  • SHA512

    e18f0977ef6a8df337e509c30e71071446b4775765ac1d2cfb69ac60ff3eaf25ab727b8f1dcb5b6cf625a9112f5176c6a74b023c275c6c2441fff650f74dc26a

  • SSDEEP

    12288:D0RAoXtl4qjTLStpow5d6XTUvyl3rMiZCdmKK+:D1o/Nw5d6DmI3rM4C7X

  Score

  10^/10

  cybergatenewdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2