Extracted

• • Target

    JaffaCakes118_2c1e75c79cdd91a9ca881c9c96deed2b

  • Size

    281KB

  • MD5

    2c1e75c79cdd91a9ca881c9c96deed2b

  • SHA1

    7c0c7ca493d87af25e212eb3155c0f0ed7f8224e

  • SHA256

    6bcbe8afb8d032bf2bd00c845327f00fca6d5e21ca8779ea1a0241ca32ec3985

  • SHA512

    daff24dff0b430c44c6fb0b5c32f51f1d6b947513ae219e406764f60f7ae045d00d1b7d486a8badebf39186e9b7a815f06c330198ad72229107796b039a08f07

  • SSDEEP

    6144:+y+phuTwlTLfkixFUQKf3D7TnBAZ5qhbxX:7+pk0lYixsfvDBAzK9X

  Score

  10^/10

  cybergatedsadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2