Extracted

• • Target

    JaffaCakes118_45c36881943a23aad24b6ebeab37f5d2

  • Size

    2.8MB

  • MD5

    45c36881943a23aad24b6ebeab37f5d2

  • SHA1

    bfc38bce2872923cd4e340bf06f712e0ba077e28

  • SHA256

    4cb0be512595fe207faaebf0d32b18642469166c93bafcb3d1e46db5dba11429

  • SHA512

    c3632670f00b6e3d5fe0e27425c9f9106c499e11a5a7b2793e4b5b4aeb960c0a608735c63042b58f7d5f69550f8e431fff6dd521159e3d30a10e1429acce3719

  • SSDEEP

    12288:DMMm4cth02Ii8znbax/E0ur6m11IsXvc5n5AihxTE2fG:

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2