Extracted

• • Target

    e379f7e08b79fd151180d2fa8b543fca_JaffaCakes118

  • Size

    321KB

  • MD5

    e379f7e08b79fd151180d2fa8b543fca

  • SHA1

    3778705117be9422d2536f432b4970b2c3955a46

  • SHA256

    b3ad3ba020b1810a32789f9cc4f253f7b545a8cdb760ce590a1a89fe75933241

  • SHA512

    b3978b13f3c1caa503c4dad751a9e871d165b1a530eccedec00c1f771c70e635c3708197fe0cba933b2302ffdafbdcbd8231736f5dbfbe8e539f182945dea901

  • SSDEEP

    6144:698cmu95u34w3oV2WkvWk2Y1lU9+RqSEZdmEoAlK3rP32eA:69jp5OBooyk2YU9WqVK37JA

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2