Extracted

• • Target

    be7aa4d49c2a2218d4f89aa38efb93a2_JaffaCakes118

  • Size

    264KB

  • MD5

    be7aa4d49c2a2218d4f89aa38efb93a2

  • SHA1

    cc57afc95384522224a00b21b1e93e350ce5c0bd

  • SHA256

    12e802f0f99ac1228a9e8d20e69f10b06c634346fe0067e58216ed7f2a693550

  • SHA512

    919cf8a5255c76501e0469b605f6afc36bad3ec6eccc3e0cc018c512e627d750b3d59771be7b3ea27042c6be5257006de271c5959c67d5e5dad4753667420deb

  • SSDEEP

    6144:XkkoN2DGukkYj3GOZITj81FGlTNvA8nZH//mw:0k6IGuU3G8ITgKTNvxfew

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2