Extracted

• • Target

    e6273e751e076fbc0889ee97c65887e5_JaffaCakes118

  • Size

    554KB

  • MD5

    e6273e751e076fbc0889ee97c65887e5

  • SHA1

    6d85a2ae5b60bd6576fc526508490a255b01d9b9

  • SHA256

    ed6e92ecffe0d795327c491109836e7ea7d0ae75cc2897be0c38a14ec58f4d74

  • SHA512

    34ba709534a39575e76da5c753ddbe14a3f04267000b1a7bb667818f1d5f84166a61724e98ea32d0accd8a9b69539ccb64a4b4b6fe9771fab6bb712ec658c14e

  • SSDEEP

    12288:I+uEhTDrv7r2bDmPn57/BhJrpD7xtWTdo4nW0e:IyhSqnhtp0qBb

  Score

  10^/10

  cybergateabaajdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2