Extracted

• • Target

    JaffaCakes118_6bc6ffde15905a5e0ed836eed634364d

  • Size

    445KB

  • MD5

    6bc6ffde15905a5e0ed836eed634364d

  • SHA1

    78cc03b4d57a8709fcc90096a9db7800196e02b4

  • SHA256

    51d482bdd99648b9eb5c5387f44063927b1c907c40fe7dec911c93dc278a24db

  • SHA512

    492cff6a645c8fc6674d659c3845c964acbecb5ea5bd6af53ad435441bcae18377fad545190669c9ab884818c0fa7aaf56f6ff75f45f0df1700d308154a3eefc

  • SSDEEP

    6144:QaKMSD4Yuae8jp0yN90QE2OIhdGCkyE+cO2eHT9ntTWzP/l33kEPr1oQGA1t1nm:pK3D4laey900FTGPnO2A9+/7Lnm

  Score

  10^/10

  cybergatepcdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2