Extracted

• • Target

    d74a1152fb22f849a6f6b6a3ed84ddba_JaffaCakes118

  • Size

    276KB

  • MD5

    d74a1152fb22f849a6f6b6a3ed84ddba

  • SHA1

    1fe87b749256e3bdbb8d5e242afe8a65f21a0341

  • SHA256

    6b2ffa6f8ef6699bae6445164e6a139dd9569139345e6995674d98ded32e6a41

  • SHA512

    036c2462557f1f9282a00dfc1d18a145f7515b34b4b66d320f33ad459a90b3cbd04f7ed5a1e3aa8f8474f7b0308d7d5e9ce0ed1e3277f6f50023794f6d6fca79

  • SSDEEP

    6144:dk4qm/tjGN37M2QbVUVCjFXeZE5fhLWQh23Fk/sS:K9lN3IgC5JVhwk

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2