Extracted

• • Target

    JaffaCakes118_165227dcdccfd5397d4b3f01fc95928c

  • Size

    284KB

  • MD5

    165227dcdccfd5397d4b3f01fc95928c

  • SHA1

    fbb90897011b69cacca08ef8301c75ac13d642f3

  • SHA256

    29e274e9e4e002eb81b27c0d5d26068a26a28f37727f1978017bd22a26434698

  • SHA512

    c97350a3bf309f9548c2199e1b76a0d13bfc5b65fbe5eb2576a3b96c0220b88df2049b215a6dd1c88a9ebebf2d908a361698e0fc0c51e060fcf65c43ca204456

  • SSDEEP

    6144:ok4qmh3K4U6uNDZ+f3jbf0ST4kgDq0hwHvUfPPYnb1:T9KvuN1+fTLMkgDKvUP6

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2