Extracted

• • Target

    JaffaCakes118_6a86fa4caf935d582001c1a4b3a2cec4

  • Size

    345KB

  • MD5

    6a86fa4caf935d582001c1a4b3a2cec4

  • SHA1

    f13f84862e118adb7558b76b24be1f9390e61872

  • SHA256

    ce3c83cb9c09169ed7b2b4f5cef17eaa5d24f0ba11ea73755591515392342b15

  • SHA512

    271df45609e0d5c9fa24d2463f22fa25f1b2e8007cc62d9323b7192c5296152593d8c7103e00f840b6b1cd40812eba8ee0fa0e8a8897f918fec0959fac76a7cb

  • SSDEEP

    6144:xmcD66RY5JGmrpQsK3RD2u270jupCJsCxC3ID6hG:EcD66jZ2zkPaCxn8

  Score

  10^/10

  cybergateserverdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2