Extracted

• • Target

    c92cd979a54b6728e2bfe9a6fb5b8fec_JaffaCakes118

  • Size

    7.9MB

  • MD5

    c92cd979a54b6728e2bfe9a6fb5b8fec

  • SHA1

    df43799b53a141732f288e3d3fc70c1d35e530c7

  • SHA256

    78058bfd528ccd286a003868e2a451e20f9617c4ac6b293b728faed15aa8c109

  • SHA512

    e69230d806638e8308ff2de1e4b71bb08d25b2fe9372cda897a0ba95c7272bd87d5e1a592819c32ce945eab3c5f0005663b65bc843aaa497bc6f44a12a0a90e7

  • SSDEEP

    196608:ltY31nkAjdvKKM4PrMY8xS/0oIqOd/5ZftPuKgQ19:oKKSPS/0oCFl5Xb

  Score

  10^/10

  cybergatefbdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Molebox Virtualization software

    Detects file using Molebox Virtualization software.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2