Extracted

• • Target

    JaffaCakes118_6d5fd40799a42ffd8e2ab57fab0abed6

  • Size

    276KB

  • MD5

    6d5fd40799a42ffd8e2ab57fab0abed6

  • SHA1

    3c2a669833c773c523524faf3a167860f912be48

  • SHA256

    3e2ab3f250116930ffd1e88261e05e0dad0c260a5e143efba0ed70134cb5e43c

  • SHA512

    d7b28ec8ee9c6b7a35e4471b7712f896dfc95d319f7b1cf6787b61c5e12fc5ef27964ebec1d15fd74d44e3585da380f2738ac22befcdc05d0fd9017250161a15

  • SSDEEP

    6144:sk4qmSiaBZTtLFDv3+5U5fXURg2mtU9+RNHocQfX:f9CYTRFj3Axg2UUU

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2