Extracted

• • Target

    f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118

  • Size

    816KB

  • MD5

    f6f9c33064c496d8faacf49864d8d1e6

  • SHA1

    61c0353c728115c06534efc2db99138a242b9fc8

  • SHA256

    b4582b84ab4f35c9748a7eb46af56e284809d8d0471a5bdf7945b87f466d5794

  • SHA512

    b2b4d2d4736ba73bedad6ae45d9d30065d6a013b85f6d86a91e5640f7b3333796d6f4aa10db9b283872c2de359fae62d84c3dc401b87dddeb775b82b8203c095

  • SSDEEP

    12288:x5ngB47RTWRuBFmmSPhyUZGuBiRS0CvJ5tD5iX4RtZXChQU9L7n/Ni8+:T/9ycQP3ZBBiR1kntBZXCW63/y

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2