Extracted

• • Target

    e3fa4bcd23014f0f52872dc0a6f17b7f_JaffaCakes118

  • Size

    1.0MB

  • MD5

    e3fa4bcd23014f0f52872dc0a6f17b7f

  • SHA1

    8a698f8a6c70b337f7ec6da353c626f52f017c5d

  • SHA256

    e171748a4ad6b9f0cb52f38a30f7101abbd11c844534ced2df23dc8cb2b92003

  • SHA512

    f496155fa02c07a5d46a182d836787ddbe47727effcbe0357e14ed3b1c9e78a2ef4edae6abf0ce01eb9e7a6eca698ecdfc0c422c7225e5868ca355563c9248ca

  • SSDEEP

    12288:BNtk8zA0Ltto/OToWjXHPhQBeAaIcnwPR+fQN3PtLlLy87WbajQsG429KgfZ8yxd:BNm43jOunnwPRcQhtF7El420wMkCCYm

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2