Extracted

• • Target

    f735806700f3bd78e05758b7d67ef9b5_JaffaCakes118

  • Size

    662KB

  • MD5

    f735806700f3bd78e05758b7d67ef9b5

  • SHA1

    6ba39f5a67e436fcd90bc394bc27db784e434ed8

  • SHA256

    ba0d6fedac3fb326477078b3605f899c060a4227ae43f61b2ce8944f0d8e7a7f

  • SHA512

    8c659c9cae89dfd78ed9c121ae144dffa70d9e73929e86fdb263c7a5604ae835a360f6604b0f85dc225797967e56a79cb38eb54dcad4b0e9920483b71361695d

  • SSDEEP

    6144:i/Uo95ZqgpJQAqmuplAC3mVJNxUCqsREVKUbOFN3KuPVpz/SsHSqUnXdqn:isw5vpJQALouVJNxBc8HLZVp5SqUnm

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2