Extracted

• • Target

    JaffaCakes118_0c3351bb24364fb222861fdcc0f347d4

  • Size

    472KB

  • MD5

    0c3351bb24364fb222861fdcc0f347d4

  • SHA1

    db9c116e0fa1454ba64866560183f7c53ac17933

  • SHA256

    1392bd1fe5eabc5023255f9e9656e215941c35c4943dd816c8b605cc82445722

  • SHA512

    af4b9decd8ccf87c39d52fc862ee05c8bdb5fe3e7f5ae761ad6aef99a3d30d8d26d7b91019bf9954cacc9ad36fde010e191134e850d476b787b888b06312c0b6

  • SSDEEP

    12288:opxx53QbEUcWE5Uvy1R/c9/KUDaCzlCkh2NlVOhpHwzK:OjxQbUrUvIR/cUUDaCh/sbVOWK

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2