Extracted

• • Target

    JaffaCakes118_48ed00dfcd3f4c5ac2a95978c175bdf9

  • Size

    472KB

  • MD5

    48ed00dfcd3f4c5ac2a95978c175bdf9

  • SHA1

    09a5832e2024b73a3f8b05aba5b4b27cde0fb24f

  • SHA256

    1d629db4755f8e6eaf0f1b80c720840fd6496ac249e95bc9a615f79e204a452c

  • SHA512

    0bf47cac2611453db56e82c3039c8585993504c894f7cc3b0a3c8b4c6d5b0e20f4fd3d100fb4c92e108a7106ff8e2e53cd77aea5df72db7a94b72aac54ea7570

  • SSDEEP

    12288:pX3W3YWO9oXa8elN/HUHIG9aVpVdTL9ZVLBJiMIip:pHtLHU8VpVp93L+q

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Molebox Virtualization software

    Detects file using Molebox Virtualization software.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2