Extracted

• • Target

    JaffaCakes118_004dd49162ea4c3a5e2d339dadc35d93

  • Size

    4.4MB

  • MD5

    004dd49162ea4c3a5e2d339dadc35d93

  • SHA1

    4b48dbf54b57094656785c0ef258db0b3c0e6859

  • SHA256

    da6de9f0878549518a78b100039e50a15fdf744efa0fa955da48237f6a3d4d63

  • SHA512

    8495d8e5d82d3a7777ed6ac6ae4e13c7a48cf5801613df5b637df48fce5adfa1f9dd5de59555e509a142a6dda07bc296a14ff8b2e0b19316ae046617cc96a9f1

  • SSDEEP

    98304:dEFwscAeiqpnlH2ZAfJTkNL7hc8HgBZzsKk5wJOTJo+mP6JR7Dv3DdffIwevcmln:Oncs21Nxk/JK0W8vB3IYmJH

  Score

  10^/10

  cybergatev?imadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2