Extracted

• • Target

    fe4cb526aa92e01b5fd9d628a2aaf7d8_JaffaCakes118

  • Size

    274KB

  • MD5

    fe4cb526aa92e01b5fd9d628a2aaf7d8

  • SHA1

    14a52215086ba1382158f7c1b1d8f9929e242883

  • SHA256

    d0da2312a9caaa8ae4d38c96683142c1e43db9c640fdf3f1e929e2d02f09361b

  • SHA512

    fe58457d8711f29ca194f756a4503b29c3001f4e9bf8278f9f773262c0512f430b8d3374a8ad1779a5d27a41072495e20b7b43812a44a0e4132a850db0dd3ab0

  • SSDEEP

    6144:qMIW9S7wV7xJOhi76WLG85q6RqO+Rh46+RtY/QLK:qbmYwpxMFY9lIh4tRtY/QLK

  Score

  10^/10

  cybergatemaindiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2