Extracted

• • Target

    JaffaCakes118_06e66250d607188c082159c2128ade54

  • Size

    393KB

  • MD5

    06e66250d607188c082159c2128ade54

  • SHA1

    58eb1b3a6f475277827657368b1de9bdd1f1e6b2

  • SHA256

    d1eeb57214d61d82bca28bdcdc20692c7e66be20823d4dbf5addb0c256978622

  • SHA512

    1646618913525b538965f50de0a8683ab36daf346620732443a729ce22a5385e2b9069936b1d5cbbabd08ece51c788c81306ee159b2272ae636e6a6bf8f263b1

  • SSDEEP

    6144:AIH1WPBOWHItdmEAmEMv7pj+sdjSk8TEbsVpMcEW+8E5yyofN/ePzSKoSe9gH/OS:TMBiAmdtdVBwEKE5VowFKgH/OS

  Score

  10^/10

  discoverypersistenceupxcybergatecyberstealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2