Extracted

• • Target

    JaffaCakes118_044e29b5ca7559330aa9e19efd45eed2

  • Size

    3.8MB

  • MD5

    044e29b5ca7559330aa9e19efd45eed2

  • SHA1

    402b4560c5a57632a8e8e00e5ee667d8b2995c13

  • SHA256

    5bce51483ff4ea82a1ef59e641d56035b856724dfadf6793822465f05b63f656

  • SHA512

    e52763ed8cded68b137190eb57b43e48103f48b6191e8e86e737368510a0c245240b79582d070237931119d12803f1c05c9d21aa0e8180827d103897209da333

  • SSDEEP

    49152:Ig8gdzU9m1vlEXKhuuYQQE2dCW2w0uVLTCuirrjr5K1jZh8gdzU9m1vlEXKhuuY2:Ig3x/uZoBKhZh3x/uZoBKhA

  Score

  10^/10

  discoverycybergate1234persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2