Extracted

• • Target

    JaffaCakes118_110a74639e96d79b06aa6fedb63623fa

  • Size

    394KB

  • MD5

    110a74639e96d79b06aa6fedb63623fa

  • SHA1

    5f54b2fb2c1ad6a339b4cd13edad06d026f510eb

  • SHA256

    bef5b722091b5c9b310a0931d417e373e0b83678bde7972001a50066fcee52aa

  • SHA512

    c4ff77e77474f92f70ab724077ca86be87283524aba4b0edfc3f518eb5c48db923aef4518ef806e2c9bbc266fc256d002086832b9058c688b327991f1f846872

  • SSDEEP

    12288:VNI0SQpdog1jsPlqkR0axvHuL9L7oNGPSnA:VNBS+ig1YqEvkh72I

  Score

  10^/10

  cybergatehackeddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2