Extracted

• • Target

    JaffaCakes118_2ef634f1bccd0a7d46373c65d91301a1

  • Size

    2.1MB

  • MD5

    2ef634f1bccd0a7d46373c65d91301a1

  • SHA1

    9caa87bba2c342019f5efd4860f8406c76a41049

  • SHA256

    bdcfadf26271cf69e3da46bc10fc86f6605fb9866895a2920e4e2b1f4e49ef4e

  • SHA512

    c89f23b8ee639b13cf2f931732c4e4c45627a5035111648877748dbc55df4884c6017101733f980a92985139d9055cd2f6c4c0723048ce6384a023deaaf35afb

  • SSDEEP

    24576:PhZOkluN7G7N8ACfDKjg10+eYJwb9vov744BZsxuUuBodlOMSPCWs4c2:rO4QdpJwbJS744B+uxBodlOXPCR4L

  Score

  10^/10

  cybergatebifrost 1.2.1discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2