Extracted

• • Target

    bc91300757ccc88108b0b7e006510c8f_JaffaCakes118

  • Size

    318KB

  • MD5

    bc91300757ccc88108b0b7e006510c8f

  • SHA1

    f68c2da8f581c7c22e8f1105c42d58bb572490a8

  • SHA256

    abfb3b4bc3ba78dfe6b284c020cee255b732750db0f083e70d6de656792aa649

  • SHA512

    90d0145d2b554a09b053c2d9c204775c7e39a5571c33b63932df97044fd6f0865d3fae206c2d796bfcd26017e46389217ce86d4a3ec12d6caeef1e66b2607e75

  • SSDEEP

    6144:wqRx6q0+uqbsdQy20YNKKIMESH5vT47OlTbDhQXr+p8KRhCTn8rVfNYo:/gMuqbuiNKKN5L4CpdQXrI8dT8rVfb

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2