Extracted

• • Target

    JaffaCakes118_10e297d2299ebad17f0c3e2d4ef82347

  • Size

    264KB

  • MD5

    10e297d2299ebad17f0c3e2d4ef82347

  • SHA1

    7b95c9064774ffddd51d90bffd5a7efe2c5b96c6

  • SHA256

    330f7157c1b2d2cc908b1dff8efd908df35ef578f70b9c20f3eb1ea3189cce67

  • SHA512

    a0d5f06ea1706d4cd061a41800af1b38cc46a219b2730b5b52864386958755247d09ef4006478337eab29e0a0aeca027c9da43705c233cdfce1f67f6d350a1a1

  • SSDEEP

    6144:QkkoNBi7/uD3w8C+oCbQatuaIAe6GlWKUJElPWU92I:rkOg7mzMSQAXIAfNKUKWK2

  Score

  10^/10

  cybergatedunkediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2