Extracted

• • Target

    bdedbddd89e666d6e95e52652e5a4059_JaffaCakes118

  • Size

    290KB

  • MD5

    bdedbddd89e666d6e95e52652e5a4059

  • SHA1

    a4a4e994876c8a0192b632c197dfebd5c7c19205

  • SHA256

    064a2fd07ac77925129ed7e819de03c3451398bd4b667db6ad5390c01c79b79e

  • SHA512

    8be2930ad7a790c6881c98a313dca632341b398c4f9f7e855d4cf054814af21e8b1d1f42cf5267e4b9e0d7d98a234107eee30f6607510f4f913486a6d8fe0594

  • SSDEEP

    6144:2OpslFlqYhdBCkWYxuukP1pjSKSNVkq/MVJbW:2wsl1TBd47GLRMTbW

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2