Extracted

• • Target

    JaffaCakes118_7a9a0897c605fa7c2e1b140bc7cdea50

  • Size

    267KB

  • MD5

    7a9a0897c605fa7c2e1b140bc7cdea50

  • SHA1

    5cdcd328f14984506c314ba2247dfdb8c6228fba

  • SHA256

    32fd0b245454b2ae8ae902d41d10517354128bfc343f239b476e20308082a36f

  • SHA512

    3271889c0984942f5e13c35a53da603bf91cf5d990956eb57873be5fa65085e8e6d4da4a45b1fa2d78d885614ef9e02bdb9725ac6c26132b21f427c97501e127

  • SSDEEP

    6144:dkTsuQgbjuzTN0WaKgvMJuzjkFmL0D2O12xhk29p1rtvHr9BjIeAIm:K2gCTN0WK5amhi2zTxr3j

  Score

  10^/10

  cybergatelammerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2