Extracted

• • Target

    JaffaCakes118_004837e51ed876657d3f3c2e50d53a49

  • Size

    276KB

  • MD5

    004837e51ed876657d3f3c2e50d53a49

  • SHA1

    fa77df1ef9440945f4cc273ff29911dfc15cee5e

  • SHA256

    aab0bc7757e6f25e87690422c307e20a24aa2daa9af2f313b630a4659209cece

  • SHA512

    5d2f036a73021caf7969ecf0acdd878fb913033b68502a048a464b426eaa4ea867529fd8b9f0d6aa038e3c56eb5e1ba9d3ebbd3a3d35af8aa2557ea281a028ca

  • SSDEEP

    6144:Rk4qmXDA8Hwf0Vea6o4+IAtpI4tGadjEXfpyP2:G9itVc+IoOOGM0p

  Score

  10^/10

  cybergateïîá +çáúñíódiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2