Extracted

• • Target

    f1b51f71650cee202f0f37948d4dec27_JaffaCakes118

  • Size

    962KB

  • MD5

    f1b51f71650cee202f0f37948d4dec27

  • SHA1

    5c34dc037c53c13e7d9ef575e0eeb304582f4732

  • SHA256

    1e39f26e34fb70dd89e53c46eb093dc247a7f97bd2ab876782e449dcff5ac704

  • SHA512

    b7ddc14d5421ff427b90d922eaa335b824997499f27b7c9504591c7ea3dcd5cd81cd6ad636a00fa4884f25c367ceaf9c5fe935f17cd9f7b519669a5d7378db78

  • SSDEEP

    24576:acQ00QO0QVY60/0nGPM/nV7lkq/m2hJcax2EOZYgUjWgMfTHso33ajOznfAN8:acQ/QOxVY6yvunHkq/m2hJcax2EOZYgt

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2