Extracted

• • Target

    JaffaCakes118_3aa8fccbd823138357f33a3247844a22

  • Size

    462KB

  • MD5

    3aa8fccbd823138357f33a3247844a22

  • SHA1

    9371f9ead0504973e0d445b2b539718295a2610d

  • SHA256

    2b8dd463b8ecbbe067b5c51cc04a02bf05387d69a7c378dc541b61007ed99269

  • SHA512

    d18be4afa52694fca435b9f8337cf54d23df11862001084ee3fe95338003c067c0d2933398012767a08335b158c7c6735efe4c3fb17532c0e0b71b5147995c7f

  • SSDEEP

    12288:YQIHrcKtRHRRRRRRRRRRRRRRRRRRRRt9NF8u5gTR6mTijlPeC18Exoaz:YQIHrcKtRHRRRRRRRRRRRRRRRRRRRRtT

  Score

  10^/10

  cybergatecalidiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2