Extracted

• • Target

    e7d3ea5ba9157ad0e001fdc5fdc4eb49_JaffaCakes118

  • Size

    947KB

  • MD5

    e7d3ea5ba9157ad0e001fdc5fdc4eb49

  • SHA1

    9cd5a3279c48d1cb40a21859bb2432292a8209e3

  • SHA256

    c028075e141b64eb587bab910714d82d797aa0522fba07a78a35e5003edb28f4

  • SHA512

    0cd6ff28da35cd9ad48fc21dbb1ce722c995b332c3899cfabccbe89e7e4f9a40f48fa337a3e75029e61e2fcb31985988bfc71004b493964bd50854c0add4eb93

  • SSDEEP

    12288:wUd7/WF7/W88a7/W887KKekck+rfn80IEZ7qlsMmKHI3iGLE0kuGnESB1:wUF/G/1b/1EKKAkGXB4sMmKQnMtnESv

  Score

  10^/10

  cybergatecs5 activatordiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2