Extracted

• • Target

    JaffaCakes118_6c388dcccaa059e5f20701b39964127c

  • Size

    276KB

  • MD5

    6c388dcccaa059e5f20701b39964127c

  • SHA1

    c33a4b77fe59951c37394919481963db0b4dc1fc

  • SHA256

    05a77a198e5c39d7e00087a4d89c6dcad705c3bd2f0b306f0ec7acc630f939a1

  • SHA512

    f51e0dae7aaf1488b8c93be1a61c02c99cea72af683de3e0a7033959426e2eefbfdbb839488068bf5dea653c1507ca6421d6e5ded45471ce3de6c4d17550e486

  • SSDEEP

    6144:Nk4qmG+aoaTdbj8Xn80Cq9iGdbhmb2REllbOmS1fX8iMhg08:a9usTVQX7ywdmavmMX8k

  Score

  10^/10

  cybergateconcha peladadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2