Extracted

• • Target

    JaffaCakes118_14edddb5e6ff8b78606250c4011c846d

  • Size

    281KB

  • MD5

    14edddb5e6ff8b78606250c4011c846d

  • SHA1

    7192e875fc2ac575a35cb969b00d2c4dffd73f58

  • SHA256

    16be78c76dc2abcbf7fd96244d1b9a61e9252190402523f3b97a3ff0f8467a63

  • SHA512

    692bbe9fdc3770c950b269abd4d228b44b02fb47584d7a328472b5581ca0272dd80a9df50f9cc47a4f1be4afd347a9174a9d5260c7960618b7decb5187d8afb5

  • SSDEEP

    6144:gScrL/4mp8DaWGc/YSlIipBReubLzeh7Yy0DMIdeXijX:xcIyb8QSVnNyhsFMCeSjX

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2