Extracted

• • Target

    JaffaCakes118_0335516b23d53094d009d13c3024d5c3

  • Size

    740KB

  • MD5

    0335516b23d53094d009d13c3024d5c3

  • SHA1

    d8466543cd2807096afd9dc927acd083aac0410b

  • SHA256

    6e40bd113a97bd850c06cffcd983b80bc54b96bea9497eec5ce16db02e37b953

  • SHA512

    76bc1c6909c9f4ccdc92c646f617e9b0d2424e0095e335ad71522f0b859e2311b7d2e067b74cd802c56cf7bb8e1944dd79157395e76a2d58b5b3c80013d7a39f

  • SSDEEP

    12288:rB7XQwN+W7YJGucyoB24Xr96BPTuVG3TkvIm08tyWehF24rYs0BHCh1uzAHVA:rhgfWUDco4XcB7uVG3T/my44rj1IA1A

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2