Extracted

• • Target

    be1a2088dff2a759dfa2f27dd5d1a534_JaffaCakes118

  • Size

    333KB

  • MD5

    be1a2088dff2a759dfa2f27dd5d1a534

  • SHA1

    93c3b25de90fe2a705235eeac4147136f9049642

  • SHA256

    f65c4b9b40c4221def1dbae77b4fe7e37ed7c42145ff591aba377480258d4522

  • SHA512

    e576b4dad571add959c726c43b1285bf539ec05535c6c5c9872e9eb990bdcd023aaeffe0ae9da44bbe66a7e45bddc529dc5eed27f63f8ad7466161794d8b2507

  • SSDEEP

    6144:U3t6sxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPd5I7xmSd:Qt6eAtpVxagMU/plruchDofAPImSd

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2