Extracted

• • Target

    JaffaCakes118_4042067ffe079be8dc846490c0edd4cf

  • Size

    347KB

  • MD5

    4042067ffe079be8dc846490c0edd4cf

  • SHA1

    c4cf342de8d02be34325946631c3a96c4b7f0860

  • SHA256

    55ffb0c2c86d73963d48c9b466ea6a50aabaf2a36f4c6787d2a5db493b08a1ea

  • SHA512

    e8e945b3ba848ecba135a3815e8ddaff66b76df9ed549657b614c7b4ee02d7dc9fdb2226775c8200ef3baa683067f019b1c7c840be5fc31623ccd0349c3af4cf

  • SSDEEP

    6144:qOpsl7hdBCkWYxuukP1pjSKSNVkq/MVJb5IT1o:qwsl7TBd47GLRMTbM

  Score

  10^/10

  cybergatehack1discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2