Extracted

• • Target

    eaf47c8c60d04133cc28d7d41e097a27_JaffaCakes118

  • Size

    296KB

  • MD5

    eaf47c8c60d04133cc28d7d41e097a27

  • SHA1

    60aeacc9a0653affff5ecaf94464b16751b34fd4

  • SHA256

    c8fcdd3c6e45c952031debb2d9387bf02562819aba8bf9c4f512c9ed22cdc2dd

  • SHA512

    49e696002b65861498abeca8b2a00155e57aec313f58d16b000ff78e04559cc9d8031f8a914ca2f4dceea01529e2dc4e0bf37d5ed6ef1062406b18488fabaebf

  • SSDEEP

    6144:POpslFlqEhdBCkWYxuukP1pjSKSNVkq/MVJbf:PwslpTBd47GLRMTbf

  Score

  10^/10

  cybergatejordydiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2