Extracted

• • Target

    e5fd5cd72bda456ce82b647dc4596040_JaffaCakes118

  • Size

    3.9MB

  • MD5

    e5fd5cd72bda456ce82b647dc4596040

  • SHA1

    f173f0d9419e922f2aba2456fdfd6869cd23d4d9

  • SHA256

    c15c7269d4aac43f2123f83852375e3f812e586a560ed2ca3ba65fe0ce2d902f

  • SHA512

    7d3d57fd2f14718e862f1b80072598d6da047294d33718e3d7f23caa338b03895df600613e9d5c30d1fa3e5d172ab9db3e6ceeec4eabc0334da172589934ddfe

  • SSDEEP

    98304:MebLeOjfh6EreTMWFMarQK27Y3dPViea64Kgq:MeHeOjJnaMKhQK27Cr4K

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2