Extracted

• • Target

    JaffaCakes118_0f35f84b4637caacef07c3d5062afa8b

  • Size

    296KB

  • MD5

    0f35f84b4637caacef07c3d5062afa8b

  • SHA1

    cb68351fc506388028cbc54615fd5d88d11b7d03

  • SHA256

    c9919d73f174456b3df61cc3aea2208d4ecdcbdd2a12230e86762dcf47ba0517

  • SHA512

    8c6abb9f21aa0a2e71b93c6c0b485177f9fa0d9a21e4077cac37ee9d8bb643c9182b54a5a0251b0fe9233f03b31e489431ec2747774728f1c39cbf44195897a1

  • SSDEEP

    6144:fOpslFlqjhdBCkWYxuukP1pjSKSNVkq/MVJb9:fwslaTBd47GLRMTb9

  Score

  10^/10

  cybergatekickerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2