Extracted

• • Target

    JaffaCakes118_0c3408f90f68cd0441dbc541ed0c4cd6

  • Size

    606KB

  • MD5

    0c3408f90f68cd0441dbc541ed0c4cd6

  • SHA1

    34ed5411bf2e6c3dc84dc5519bdf28c35b151ecd

  • SHA256

    27e22c683267a7c387101c91bfc2ab8765526c1eebd583042f3b98b4c5cabf66

  • SHA512

    53c8bf2d946e29eeb0f6a9cf5a60986da6c2cc3a0383311d6b040240932241e2a70d5fb1370e0418ed025a18d86e6b15aef0ec0c285f38a6b5e04797bcc087ef

  • SSDEEP

    12288:A6Wq4aaE6KwyF5L0Y2D1PqLcE0krsskaVs6mDyvapNNoafLW:WthEVaPqLdqsRVVCpNNzfLW

  Score

  10^/10

  cybergateismaildiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2