Extracted

• • Target

    da28bfe864f65d6d158a849b65d85bad_JaffaCakes118

  • Size

    296KB

  • MD5

    da28bfe864f65d6d158a849b65d85bad

  • SHA1

    0302d4bde755d73618993bc8fa80a8f8b86888fc

  • SHA256

    af0cb06c251e25f519a762d6be4f87a4eee33b6caeecd5afd6e5da30a6d2da7d

  • SHA512

    15e1697a5a96dcf46e57447ff91a83cab45a4f75d046ae3bf0b56acfd25975902aeefc46aa3a7bc28832d8b6848b94736647005a219cd250536e22860448f0df

  • SSDEEP

    6144:POpslFlqHhdBCkWYxuukP1pjSKSNVkq/MVJbF:PwslITBd47GLRMTbF

  Score

  10^/10

  cybergatew00tdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2