Extracted

• • Target

    JaffaCakes118_61082949c7784f589f7b8e308ca10910

  • Size

    274KB

  • MD5

    61082949c7784f589f7b8e308ca10910

  • SHA1

    e89f4043cd428262cf6012ccd56c7b306fcb8e0a

  • SHA256

    e15a985d5a4f252145354a07b6f49a2213cc2b3a0fc9fe29cad04c7cd2b5083f

  • SHA512

    e5f9716269e45fa598b7454834ae041f8974a23e53bbe25b1ceb2964400e75341d0420cd9c3c6321a9c1def1473f53c9ce1fcd9aeb4cd3c87ee8ccdca6812795

  • SSDEEP

    6144:LMIy/qCS4G06LZP4igjG153q/ZUzD/GSxOZ:LbAqSG069421536yLGvZ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2