Extracted

• • Target

    d1e88c87301ada7d1f88b4ef6df8d4c2_JaffaCakes118

  • Size

    830KB

  • MD5

    d1e88c87301ada7d1f88b4ef6df8d4c2

  • SHA1

    6aebaca1674a9ffe94305b402966d75403e4db8b

  • SHA256

    bf9cf6bdf04b59c49b095a946f804e6e0f14b2a501200273b20ac0e6f420627f

  • SHA512

    748b2749d7475e34a0a7b6ebbdbf24b15facab6cd5a68aab41aa1f2417089ebb6c889ed375210d4d8a491d8997cd5572f44e714458ea55981952bb958c2dc7b2

  • SSDEEP

    12288:m46hoz6V6mo5dp6kKKyifteHuaYEK8hy0KRCbYsh1+MBcbVJXNw3y6HKUGZEjiTz:mJOXmoQkZnBay8hyZGzXwJu4UGZEmT06

  Score

  10^/10

  cybergateanyeduwudiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2