Extracted

• • Target

    e5e3c5395c6e8e0da42944881e1c352f_JaffaCakes118

  • Size

    283KB

  • MD5

    e5e3c5395c6e8e0da42944881e1c352f

  • SHA1

    7b0c5096d798d72e985d04f33ec2123469c5fb57

  • SHA256

    1a36d388d866bcbbf47f7996fa78c615f1791171933aeb7c5ea1cb4bf22a3ecb

  • SHA512

    05fa7c4ed402ac84d3121b952eee2d774fea9a378faf071cf323d182d668c224bf9617944ca2cf1a6280af1c1a26d7787e98529cadd173d13f357df3ccf50512

  • SSDEEP

    6144:t4ABF94fpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKX:2UDGLE0kuGnESBX

  Score

  10^/10

  cybergateadmindiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2