Extracted

• • Target

    JaffaCakes118_3f8645f1fa6aa2740bd8964dd977f416

  • Size

    1.1MB

  • MD5

    3f8645f1fa6aa2740bd8964dd977f416

  • SHA1

    63f72bf181863cdab4996c93aa717718ed4c58cf

  • SHA256

    817556a428d4da0ef6964b91da283f47703542fda96c39f8f955cd75cc58ad27

  • SHA512

    ffd706f8e3d84375fedb39ae50cb52775e323816748ab9322c17a382c67a7c284de6bfc13860f6679b9598225fef8d40dd64aa2f761230111ba71560a5f3a244

  • SSDEEP

    12288:jTZgy9Qd19XqJdjSGUiJPgOTiwe4uq9DpWj2QjP4wKbs8O523vCxueTC/J1hfDg1:Hed9X6GGUvwvWjtr/yv4fTC/xg5S8c0

  Score

  10^/10

  cybergaterunescapediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2