Extracted

• • Target

    JaffaCakes118_244f0ee8fb6b03b0992a2aebf3b59a71

  • Size

    296KB

  • MD5

    244f0ee8fb6b03b0992a2aebf3b59a71

  • SHA1

    ef2e0383a2a050e2458134a7079113c9ba715671

  • SHA256

    76ff3807983403403f1d6e028db7f73f18e1c3a7c9b2aa2465ecb010177743c9

  • SHA512

    c52c0119e58d7e86ddad9bf42220f33b8543976ea4ac9795a8cb9a95ea8beec810215a3416a68c734aeded2c50a61d67d65949ac7187f74e123c16645fd6508a

  • SSDEEP

    6144:/OpslFlqkhdBCkWYxuukP1pjSKSNVkq/MVJbS:/wslnTBd47GLRMTbS

  Score

  10^/10

  cybergate0discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2