Extracted

• • Target

    JaffaCakes118_650c70619375ad139b020bc72f7ce4eb

  • Size

    361KB

  • MD5

    650c70619375ad139b020bc72f7ce4eb

  • SHA1

    0d0dbdb3461613b1fab326aa0c72727e3b89e201

  • SHA256

    17728e1bd922020a91e870c993ddbd069e720c719854c374abcdb56ae3aff298

  • SHA512

    e70f52ec7e1f3a5af840df69121a1add1f24f07ccca0073a26bd267414bac969de2d62610e55068ad7e37b37c733a0ff24b9a0c2f814cebdc9802fb0da71beac

  • SSDEEP

    6144:8mcD66Rz5JGmrpQsK3RD2u270jupCJsCxCDIMUDF:NcD668Z2zkPaCx

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2