Extracted

• • Target

    c4c45cdc6911ea89f1f11cda26c0164b_JaffaCakes118

  • Size

    312KB

  • MD5

    c4c45cdc6911ea89f1f11cda26c0164b

  • SHA1

    20e85e57fa8936e5480598c63c323aa8e7cb56d8

  • SHA256

    fce6a2b978af6ae5a02f3cb2a38a1a84df6e71712bb9f6c0290a8713d5b41eb8

  • SHA512

    65ee58e4de3fc94dcec48b4231133bd36b12644410708a332402c12de203b2dadea080cee17718861f0d251b47688d79b685c3830abe815d86a4d37c904df407

  • SSDEEP

    6144:u6wLeIWaNBA6AUtjBdIpUo637H+0zCxlq3El3vO6Ten+r7GqYndy:u6wpB5t3y16rH+YC7nl3VTe+r7Qo

  Score

  10^/10

  cybergatejujudiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2