Extracted

• • Target

    JaffaCakes118_6093495b7bca80693e2b52c8c60e3f65

  • Size

    296KB

  • MD5

    6093495b7bca80693e2b52c8c60e3f65

  • SHA1

    6001c88acc2e1661676d62c31130755f53494bcd

  • SHA256

    d1e8597baccb50b8b909b53eea17fd79df6bf05a662d0e5d178108f34aa84969

  • SHA512

    e513e230a784b44f0dec2a1c5fc862694119d40d529207326fe123d055296ee90c5b530a547ffe7fbf16806110cab5f2ac7c0ad1615c4724f3211559be03c804

  • SSDEEP

    6144:/OpslFlqrhdBCkWYxuukP1pjSKSNVkq/MVJb6:/wslQTBd47GLRMTb6

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2