Extracted

• • Target

    c48aab8de874034e126306620e6e47c0_JaffaCakes118

  • Size

    290KB

  • MD5

    c48aab8de874034e126306620e6e47c0

  • SHA1

    81c1c09883c5c012e847c2b364c0d5f8939d668b

  • SHA256

    2a15b227bc367f2f80494b48a6e7f006408ad3dab8ca83f239d89f34fccd3c83

  • SHA512

    6936044d6f6815d9d4ba071728a0143aab3f6afe59ab531cb97f78a3f8eb8688c7ed8ba73dfebda7d20eb21305c2062ab75e3d6f5d8f67ea9b75de3634f1e9c9

  • SSDEEP

    6144:zJcD660RjI5JGmrpQsK3RD2u270jupCJsCxCD:dcD66A1Z2zkPaCxg

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2