Extracted

• • Target

    b4f4584cb0c8b557a13cd4ebc28dd090_JaffaCakes118

  • Size

    278KB

  • MD5

    b4f4584cb0c8b557a13cd4ebc28dd090

  • SHA1

    b5ca68b9ad0d33af8279b22b43205c728eb77a2b

  • SHA256

    e4e22b68be8e9dadfc7ce54b475f58ee488e3cf330c2845bb2ca5e14b868d6fb

  • SHA512

    2b94d4559123cea1357f1932063579d7c6a17e84e629b4a8816b9ddc7125ac01be5255b81d6d162285b97424434455594b9a88f7393d0237a5c07114e2e1c54d

  • SSDEEP

    3072:gwiZ+qo9VSjImP9kuhlRbGqYWk4GlqaUXiRBHoxNVqhyMBzbJhZ8XpE4+1eMvvRw:GYxURCdUiRdo7jMB+ZueMd4GkEqAA

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2