Extracted

• • Target

    JaffaCakes118_85dadf9213055be7dd6f33e36aca34ea

  • Size

    324KB

  • MD5

    85dadf9213055be7dd6f33e36aca34ea

  • SHA1

    7f0fdca89c63dee0d8bcb8b425ded2eaf01a9463

  • SHA256

    66a0928f1c3b21327daf2335c12c7797d6299cfce6714c4461217847436cf6ff

  • SHA512

    1657df98890ccf32547d43c5bf00ea5b3a87af59bd4767904f7dbcdb9f8a543560a6194dfa8fc2df3ec715f7fac83d68cae4db6aef797483f1ff6aa3529a38c3

  • SSDEEP

    6144:SsZvDnvGM+5iOZci4A81sivGzj1rCL4ZWTzrFWG2DPlGT+3VPw1AB4qr2:DZDOTYSci4n1svpCLS0cTcTQPlBC

  Score

  10^/10

  cybergatetorrentdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2