Extracted

• • Target

    JaffaCakes118_7882b8b9223f0fcec1f5cabbe7f1b676

  • Size

    296KB

  • MD5

    7882b8b9223f0fcec1f5cabbe7f1b676

  • SHA1

    604b06062a2f9c6d9e5cb6563f0855cfc048bcea

  • SHA256

    b5e5b667c8fd7a86aaa768132f28fa91fdb88a8e156989613ac5c5c56cc456b5

  • SHA512

    7571c9f345bdd38e8560c3df8b44522162579ee8f69dcf82d2cde87c0ca5a73a7bb7e457044327e3282b6afb8d953aad4867507713e0944a9feaca4ecf0dcd11

  • SSDEEP

    6144:/OpslFlq7hdBCkWYxuukP1pjSKSNVkq/MVJbl:/wslCTBd47GLRMTbl

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2