Extracted

• • Target

    JaffaCakes118_41f25fc7cde11f465f1d072db0d3b568

  • Size

    283KB

  • MD5

    41f25fc7cde11f465f1d072db0d3b568

  • SHA1

    d4b8bc6b9fdc4deb11af1c65a60d7827ab3b558f

  • SHA256

    f7f0ec20a1a55bc0de3f40934443936e204d3ccd482b8682322a30f050ad2bcb

  • SHA512

    22f951556d89539d740ab9bb45d2af02b3a9d504f5b171bfb0878c151fed144cdc3e4f0ac0587750d5a9126430bbec8201b5159ecc8cd815c6b15bc947b0c618

  • SSDEEP

    6144:t4ABF940pAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKM:2UCGLE0kuGnESBM

  Score

  10^/10

  cybergateremotediscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1