Extracted

• • Target

    JaffaCakes118_3f6c54a9f85391e4dd50846190189032

  • Size

    896KB

  • MD5

    3f6c54a9f85391e4dd50846190189032

  • SHA1

    686e909d5fb30943a1b34cc6719e2ef76efe2e99

  • SHA256

    7df42715e9ac3291391fee47cdd2d17953f08b446b115a20057c6f5597d04c7a

  • SHA512

    9394b47b27145659108d8ecc60df2b74a1340e66b267de666c4f4fc0ad60c2844a5c88e10691fd5b548b19ff92f33923f6735df1375a88edcb8f19f3c2ae581f

  • SSDEEP

    24576:U+9jpSIR/998CGPMAkqAyt9kkQ1bNWxMbG:DjQBDAyt9ktUn

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2