Extracted

• • Target

    JaffaCakes118_29ce388b03b7573b82bc3dff29d4571c

  • Size

    401KB

  • MD5

    29ce388b03b7573b82bc3dff29d4571c

  • SHA1

    a9d03be13e4d784ab6c1e7bf51b9b40bcf806f0e

  • SHA256

    eb0fd450dbdeaec7e8d2387918060f162e9c76d412636ce8aaf6fb26ec1c571b

  • SHA512

    758005e3d27d9e5bb1420d172c714e6931eb29b0d32af48a8ad6d677ec3b8c17b514ed825f94eee4cbd914e5647ed6505695ba020cd9f4cc85e7b1d3b5102aad

  • SSDEEP

    12288:v8ow7j1Lq81I1JOk2AIqgD4U7OsVv0cxtdZ:Enj1msk2hqgHVc2tdZ

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2