Extracted

• • Target

    f5b34ac2e3b7b7a7ad108299ea272a0b_JaffaCakes118

  • Size

    803KB

  • MD5

    f5b34ac2e3b7b7a7ad108299ea272a0b

  • SHA1

    4f15cc5c4a8f162c7edf65a5df10b2aa3a270d6b

  • SHA256

    9a51bb8ee5fcd54ec0d6860eb4a83336183bd9819ab17570a4eb3bf209d30665

  • SHA512

    8b2455303603b1564421a873c9b3659957af5631756e8ddbf8344c732b5d3be37fb06882482673a5e597d7089789001391b9e08048349e9ce7df175c0072d269

  • SSDEEP

    12288:iDr6g/QjbsKTGPMsLeFv6SxxW14dYGRqeUKVfgWIUPSGI+1ue6xN:iDrhQnGPM/xxw4djNbIx+1ue6xN

  Score

  10^/10

  cybergatesami8007discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2