Extracted

• • Target

    afef0228b72ef95909602dae20b194e6_JaffaCakes118

  • Size

    909KB

  • MD5

    afef0228b72ef95909602dae20b194e6

  • SHA1

    547d0f06828d02e41fe38205c25ac311de681fbb

  • SHA256

    299037df2b5f62116bf7662a345c5e183e4e0c93fb811deb420df5f12c86108c

  • SHA512

    8857852897e57997e939855862b39ee9596742005dbc854c1aef282a113a0584e5cac79fff534932c6089f9881b1d512a2230065808086715324dabdab69eb1b

  • SSDEEP

    12288:8ZjMLf11MmPQeRXEHYYS3gA0FJO1t37nMtfJn0xHfSGGvm6C8Pabvxonp4:8afIiy4NwdLTtfJcqXePiW

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2