Extracted

• • Target

    JaffaCakes118_17bb69e78303a9f7b95233dc3a76162c

  • Size

    788KB

  • MD5

    17bb69e78303a9f7b95233dc3a76162c

  • SHA1

    81090b7a60a89339499e6531bdafb7c3ccd9482c

  • SHA256

    37e2fdb580342a188a8aade6a8be7282a259cc5a4b969d59e53a57f92e42f486

  • SHA512

    9852ce186b75c756272be13e04b3e443300f8d83aea406557a755b2cf0474c2636ec9537b36150dcf9b94a3f38cc9cc88a49be214050797b9e7f9ef48e6e87fd

  • SSDEEP

    12288:Tns2behvo8xcf9QlPDJSnL2r+JTBytOKADJ3H3KveGFipAhGcZcwpleo23SAJ:TF8o20Ql74xYIKAV36vxipyLPao2rJ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2