Extracted

• • Target

    f1b7c71ec304230a80f26386fdf5493d_JaffaCakes118

  • Size

    388KB

  • MD5

    f1b7c71ec304230a80f26386fdf5493d

  • SHA1

    4b6567f4c3f31d5e4dface0ae749b3fbc55d3af8

  • SHA256

    4fd8a42413039c3d118978bf590ca9906991583f2c516eedc23ccabcc120fde8

  • SHA512

    b0bbe933cbd671375f12d8f70698c011530c13f8888e310d6ae94ecc692c3edc29dd732bcb036d7b2c0a5c426f60fa28516f167993fc39a9d7bb6a1c48841976

  • SSDEEP

    12288:D3KAZ0SaSG2NQELQtsbJyC1YvYW0WYT/l1:jKAZ0aG2NQELiGoCipNmN1

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2