Extracted

• • Target

    f1d38ec32630f06839e8b8afc676a4dc_JaffaCakes118

  • Size

    469KB

  • MD5

    f1d38ec32630f06839e8b8afc676a4dc

  • SHA1

    974a5874f81131dd48948633190ec7b52cead13c

  • SHA256

    dffc05c9d596698c599d6a9bb8208f4248ee6b973fedd9e2eaea844c28e42295

  • SHA512

    dd8a225e222a4c49746f443ac6df3abe44d14785a89caa812ac1dfb85f8754c2583d99b024e4fd22ba3803eaa4b6f2510fd3961cfe0fa6476f2e4d9399984556

  • SSDEEP

    6144:8OpslclqihdBCkWYxuukP1pjSKSNVkq/MVJb8qW4JwuiNi6a+BtPgZBFOpd3cOD:8wslQTBd47GLRMTb8DywWBetYr8d3cOD

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2