Extracted

• • Target

    JaffaCakes118_0e4344de80f967f447a9261c55cc4000

  • Size

    276KB

  • MD5

    0e4344de80f967f447a9261c55cc4000

  • SHA1

    021e5f3fb279942a475ef54e5e6a5221009a5b96

  • SHA256

    a91665e64e5b27fb067b15f0f7cc610ab0d182e9bd24a59f44b35bd6bcbb435a

  • SHA512

    a10cc368e18a3e1448d53d7636582b53a49690461e75f243ed1e9da3eb12c4dcbf5dee2240e8bfb37d20a8dd5b1a1ff6079f4c9fa2b84d0c054a265738ba6b18

  • SSDEEP

    6144:Nk4qmpKmL4W9P3r/bLDU0+Ufo1rzreq1zIViiM18u:a984W9vLD3fgrzqq1Gi

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2