Extracted

• • Target

    efa091c1f9d7e8fe4fc9df1c6b33a1c8_JaffaCakes118

  • Size

    296KB

  • MD5

    efa091c1f9d7e8fe4fc9df1c6b33a1c8

  • SHA1

    497ed2525bc807d33ffd06d2ae0191fb8fe23fe4

  • SHA256

    729d1fb9d54aaf6542de4e7cd8c377b6ed78677c9007af9106c00611e09976f7

  • SHA512

    e15fc8bfa46f7f5245416237543a78ede85acaa8bb735dedbec009930724831307c0e55e4be6b7bfee53a636dd90f8916487fe8419fdd35a14b0144ef5666502

  • SSDEEP

    6144:/OpslFlqahdBCkWYxuukP1pjSKSNVkq/MVJbk:/wslzTBd47GLRMTbk

  Score

  10^/10

  cybergateonlinediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2