Extracted

• • Target

    f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118

  • Size

    296KB

  • MD5

    f6a1ba8a27922e45ae19322f412f988b

  • SHA1

    0cafb1b2e41245a0d5bfe21b47bc5274bb004df0

  • SHA256

    41ff787bbc5a98affbb97056f9b35a2ee29cb9c51ca7f6c30b30ecf5ecec2459

  • SHA512

    19061367e6dc542c6646d569a45d93852d45c6327dba35b7e24021e45e81d1517f7f3f9961abbd1fcc4ce4342acf73894b1851ea2ebe74b4fb03fc569c4954ab

  • SSDEEP

    6144:fOpslFlqJhdBCkWYxuukP1pjSKSNVkq/MVJbT:fwsl2TBd47GLRMTbT

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2