Extracted

• • Target

    JaffaCakes118_680b42e0cc453e8e696fec2b88f3549d

  • Size

    336KB

  • MD5

    680b42e0cc453e8e696fec2b88f3549d

  • SHA1

    fccbde2ca08658b147c519eff33506f36c4dde08

  • SHA256

    519fa0716a0a2c278d0422f085cba0249a30483323386dbb15584cbee7f2920b

  • SHA512

    df211d698b7d5c03908ba92c94ac4903a969a81f9c56eb3bfc1d5f2e6ff2ff171445b4a0bf47ca238c0e86cf152e40c2563da5d7e9c0b1f388f27efa8c234ca2

  • SSDEEP

    6144:FmcD66RRjJZwzZwJcQEIXKgQj6NUqV3IFJtBToREujB5wZl5DLfVq4mExyj:gcD663J01eKgQpqV3IF9D5LfV13yj

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2