Extracted

• • Target

    c6bc63f7c9e283feb2d8213d69774200_JaffaCakes118

  • Size

    288KB

  • MD5

    c6bc63f7c9e283feb2d8213d69774200

  • SHA1

    c297aa1945dfa129c1e933344cd32d0d7c9bf990

  • SHA256

    1adbfd923823791dfcfc9b1e583854a743c971be525927917b433a215c10d7d4

  • SHA512

    7464a0536bc85e55264e58f6e9c9913b219c9a8ebbf97290fb0c790374face99edb18ad9f88012605019ebf0eca413f6bfda59d59a4af2ad0774adc4e36e3084

  • SSDEEP

    6144:P8jGBFeel2swvHyKvuadF3QM4khCfcgS3LKDwH84Zw:ugeeEswvhdWk0WKUd

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2