Extracted

• • Target

    JaffaCakes118_78980376bfa8e35d6fb14a2159417181

  • Size

    347KB

  • MD5

    78980376bfa8e35d6fb14a2159417181

  • SHA1

    87c191a90135c55dfdf6d590f7f2845b989b5141

  • SHA256

    09464e0e9efc27cee2f09ee8086ba3cd432068390200d5dc744085c545cbad4c

  • SHA512

    20e9751b6afa396724338b118b86230291f757f8bf420805d858495d717c4fb58a4fb772933262749d6600f1c70d0903c9396c5853360fbc99da0e8758ad4980

  • SSDEEP

    6144:LOpslThdBCkWYxuukP1pjSKSNVkq/MVJbIIIo:LwslTTBd47GLRMTbX

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2