Extracted

• • Target

    JaffaCakes118_1ad29f68b502d3f4cafbc1db617d21ee

  • Size

    961KB

  • MD5

    1ad29f68b502d3f4cafbc1db617d21ee

  • SHA1

    077a88e3f6412aaccaf238fcf9c299e3f4ee760f

  • SHA256

    2962f1df152814a28a2aeee517e15ce17bad0ceb2620dd9d5a333ec45b7a0e2e

  • SHA512

    c7da18db14f7249a631e916a8ceb07a9918fb3c581253ce1b0b9a9b90ced01e6af38b4b80a3410f82c3494aeb548df32a7de0a7fad51f44553363dcd71f0bde8

  • SSDEEP

    12288:UEjIh5hsLnEjIhTAkAMTvK5S8FeDdVLxN/ymy/mZZMf9NJANLIRU48fSt55Er+Uq:UHyLnHSMVLxNBZMf7JANLqJ5y4V

  Score

  10^/10

  cybergatevictimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2