Extracted

• • Target

    JaffaCakes118_6ac62514e388db3258d455a40838962f

  • Size

    285KB

  • MD5

    6ac62514e388db3258d455a40838962f

  • SHA1

    37d16bb9e571892e38d79abe12afabbc88efc7b6

  • SHA256

    0fe5474bb63a4375b19d4ced3108c522ad63c88335db374e75ad2a34faeed625

  • SHA512

    4b86b1267a2eb029117b733f94abb5a65c3c22bc728c55af3f13af4e4e8ffe4e2e608e5d32f2edeeaba6329dceed894136d85f99cac62ec62a1b5b44fb7b556c

  • SSDEEP

    6144:zk4qmjjNuyhMnmBgo4xUKOphEQZC4EcY3QCh:I9ahSopKIEFYiQ

  Score

  10^/10

  cybergatecoffin of evildiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2