Extracted

• • Target

    c78846214e61d5777723f57706c345ea_JaffaCakes118

  • Size

    666KB

  • MD5

    c78846214e61d5777723f57706c345ea

  • SHA1

    7f02df32bae89f69c80e3493d5c7dc85fab33a41

  • SHA256

    e9f4faaea8b2581ea0a194590a764f3fcaf221c095055c3c4d5bcf2038a27116

  • SHA512

    ce5bfc757bffa05f22f7e44a5f722b57e48ea19a0d738db15e632ca58b41c5e89294ccb3548565c364c8c7002a70796fa2dde9b18628644faed9e20e88d38ec8

  • SSDEEP

    12288:XyJfsVVNR9ljukMul+xF7XmeuRme/iZIPdMjNtonYPA3neMRT7bqnXIKUxFT19VN:XyJ0VVNR9tuNdD7XmcEiEdMjNVPxMR7T

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2