Extracted

• • Target

    f7d2e698dadb41de959b369aacfadb2e_JaffaCakes118

  • Size

    284KB

  • MD5

    f7d2e698dadb41de959b369aacfadb2e

  • SHA1

    77a2a163a7aae40102522c88d0e319cd9d298a49

  • SHA256

    17ca5d9a72e6c99ca0af165f207676d83046dfe011b717e65cb778b5a7bebbce

  • SHA512

    6f053b3323d7990d723bf0ced1e4c1e6c2653856229b72cea85a3a0527fd5778f6b9a623eee687e67c940778d64f226c6796cba7943304c19d08de596dac9c3f

  • SSDEEP

    6144:6k4qmtz1aTc4ajf6jNOEAUy7sGUA0X0ELVfHsk1RQFb:l97naf6j4kGYVfHs7F

  Score

  10^/10

  cybergateìïíï çáãæèßódiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2