Extracted

• • Target

    JaffaCakes118_13b0b27dc6c8217d630534ff2ea1920c

  • Size

    281KB

  • MD5

    13b0b27dc6c8217d630534ff2ea1920c

  • SHA1

    34f62eec48b1cdf63f3290bb46224d01ffa155c1

  • SHA256

    67244621fee94c5515232906669acf62eda006948c5025680780d9d2ac73c93f

  • SHA512

    0a76d40c1f4e6c084d8bc57c613b6950acf76a53dc935669ad73a4991f670241004d2c3521b5cd627f1c6e00c5a300ef0c39e06a3e19ac6c9c7f80a8ad68f266

  • SSDEEP

    6144:ey+ph/TwlTLfkixFUQKf3D7TnBAZ5qhbxT:b+px0lYixsfvDBAzK9T

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2