Extracted

• • Target

    JaffaCakes118_213ccd3eff0b3835cf50cc10edd57233

  • Size

    289KB

  • MD5

    213ccd3eff0b3835cf50cc10edd57233

  • SHA1

    f805d502e4f8cb042c214474c1066735735de9a4

  • SHA256

    2eb4280cfe8c3cf90077f939bc07a128d8251c660403bd4c7613019cd3c4b336

  • SHA512

    8f1d3ffcc1fe9b642cd3c7dc99481dcbfaba77e2083a1953359422e14ea5e4c8becab3ed688763a1185ae5c8d4801fc9e6d10fb88c25e43dbaa962c363056c0c

  • SSDEEP

    6144:COpslFlqJhdBCkWYxuukP1pjSKSNVkq/MVJbs:CwslITBd47GLRMTbs

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2