Extracted

• • Target

    JaffaCakes118_9a832d07c651cc60629713015f9415ab

  • Size

    281KB

  • MD5

    9a832d07c651cc60629713015f9415ab

  • SHA1

    5963433bad111a6403986bccdc0a5be1e5d481d0

  • SHA256

    2d6b8bd44d37b4821f4d857a1ceaab635824c14ce1567cac28822c5291a573d8

  • SHA512

    22946911cc7374544b75964ac2c0aed35ab472f7d8220260a3c8168fa2d74ca655c612d8696ff65c7dec8703bd4815d876ee6612c2858b8539a934a134919507

  • SSDEEP

    6144:uy+phiTwlTLfkixFUQKf3D7TnBAZ5qhbxM:r+p80lYixsfvDBAzK9M

  Score

  10^/10

  cybergatesolczprotdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2