Extracted

• • Target

    JaffaCakes118_696daac70c9a49df195854ae394f10a0

  • Size

    312KB

  • MD5

    696daac70c9a49df195854ae394f10a0

  • SHA1

    87c2fabf9238e2cbe4f4a326cf0664a8d50d37a3

  • SHA256

    153fd1ca8ed69113101e172abea1d9f730c7d13d897e0f7f2e1d577f1116a49e

  • SHA512

    110b10d0f26fe061c4b760210d1e0f3cd6cf3f832540a05ca366d3bffff2f253935a455c9ada08b59fd5705502cee0529ebe9a8c588d29c4df17f99fb6443c1f

  • SSDEEP

    6144:NO8U+LMVUTjADg1jGtoyQPT43kzEAnGa9fRdKzcfPQa0Lvf34bvLsT:36VUTcU1qtPQPT1zEMGaVRdKzuQbvAW

  Score

  10^/10

  cybergatecasadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2