Extracted

• • Target

    JaffaCakes118_6d7b84a293ccd1347fc8e3b7f4fb1863

  • Size

    756KB

  • MD5

    6d7b84a293ccd1347fc8e3b7f4fb1863

  • SHA1

    27f801dad427981761f766189fcca4f066c21960

  • SHA256

    0c7701d23e4d749e8d92ed36d458a1a41f92947db723bb244a80315df42ee8dd

  • SHA512

    40d0ef6052d3858ad37fd2b1d73f35d50ebcfc0d788a3968b6bb568691d18c4472a21b169e607dac50a0070276a747a56ed4d67829a014b4bd256e7fa9565d2f

  • SSDEEP

    12288:n2g6yD4jcNXJV22cm7P6peq+bj3BamVwSCbCvY2cMnJLGVDuomyjlQ/1bmlN01XW:t0kXJVJcm7SpN+3mpbKc2FGVDKTpmkP9

  Score

  10^/10

  cybergatecyberawsomediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2