Extracted

• • Target

    JaffaCakes118_65f05a082f328595ed3a7d8e705c8fb8

  • Size

    688KB

  • MD5

    65f05a082f328595ed3a7d8e705c8fb8

  • SHA1

    9e934016461f29c9cb773d2bd2acb15e33a3e65e

  • SHA256

    8701e02d65914a1db70e47629b8b90acca27ab858072fe65b50be080fa8f4fb6

  • SHA512

    33ec338c9e1c1be23dbc878113e2db53a491d043c08239a19d1043333bff4c1080329a8b70afc38ba5970fada133e52911227de2dfb368d8010932bca8d9cae4

  • SSDEEP

    12288:ucD66CQ4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQR:uXLtwCc26uGi2VCHXSBzTaDMsAQR

  Score

  10^/10

  cybergatesawdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2