Extracted

• • Target

    JaffaCakes118_b7f4f98018db49318373fce84c486a93

  • Size

    538KB

  • MD5

    b7f4f98018db49318373fce84c486a93

  • SHA1

    7e300637e8cb1e44ffff2de9aba88a2eec4a1c91

  • SHA256

    ae6c23694e0008e825049cab568983fe9843d2ffff8d7ac707fefd3b9428f003

  • SHA512

    7e160a53b111d83c1cca2beaf46bb40b97ba76e5b28fb526472f61ec75bd2bca9e75657f76e53b405957a9302d1e62053511984e9e034f3d73d9e142d2e6fa2c

  • SSDEEP

    12288:I9fF8Dk48gedjd7hbIvVgG0711zF9FLGpM1J4EqJ6vq9Q8GqC2fvco:GfF8oBg49h0WGAPLf1jqJ6vqPpvz

  Score

  10^/10

  cybergatemr.victimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2