Extracted

• • Target

    JaffaCakes118_6d3a5b1535b2f704d15116beff296970

  • Size

    280KB

  • MD5

    6d3a5b1535b2f704d15116beff296970

  • SHA1

    cd1b31808c98abbbeeb8cfc8f2c26ab9e9779638

  • SHA256

    9aae6cffdf2d63477eec07ac50ed55d7567a061d63630f748d6b422dd046f2b2

  • SHA512

    93545271be112d42d56dbe0956f49c074919879650eff5bfa80670aa7cc022963a4c4f3ba3b201d096fdd393a72b90981c4e8377fd5f998f208099df3d642696

  • SSDEEP

    6144:O3LZlsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdh:K/eAtpVxagMU/plruchDofAPH

  Score

  10^/10

  cybergateslavediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2