Extracted

• • Target

    b191143b050d3b485eb26743a52b01d3_JaffaCakes118

  • Size

    540KB

  • MD5

    b191143b050d3b485eb26743a52b01d3

  • SHA1

    0fca3acd3847f63a93d13494c6273b3fadf7c6ec

  • SHA256

    7fbf2339178ab8d9c9ad3b6f0734393b9cb1ca93b018f858818ef391a68d9baa

  • SHA512

    4345b5db9e3f5e349b34abed9d5a511f1437f32886d06711a59d7bf1fc9f3b19e835c7a7bb7cb217550cfbdff1a2e75c2c5bddda842e315eb2464b83daa2a1a1

  • SSDEEP

    6144:wRVuMTZ78luSl6BacmJT8aSyVRWTsLO/R9zB+auG/ECI3BujPetrSiqH0W5oXNyY:i6uSl6B24aJ+59zB+/jCGqPetrzLNXc

  Score

  10^/10

  cybergatekissmyarsediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2