Extracted

• • Target

    JaffaCakes118_69054cec1f89b2168d134a64299fedf7

  • Size

    296KB

  • MD5

    69054cec1f89b2168d134a64299fedf7

  • SHA1

    2608a37b0c5f32f914871eacd9ac773118f6ffab

  • SHA256

    5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9

  • SHA512

    9e8c939cf5e73b8148db2366484ea0d91c49daf024b6868d12c24c0d9ecf84b2622758d4809d8c5b722c7325356436cf89a62041bcb17ca6988e5c4a50cd9e8f

  • SSDEEP

    6144:uOpslFlqvhdBCkWYxuukP1pjSKSNVkq/MVJbq:uwslmTBd47GLRMTbq

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2