Extracted

• • Target

    JaffaCakes118_212d82e07184e9bdb06d8cb042ed2009

  • Size

    281KB

  • MD5

    212d82e07184e9bdb06d8cb042ed2009

  • SHA1

    8071739ab87dc551de5668f79ceebde7f6cceb16

  • SHA256

    496943b2d260122b9f894025c2508d002532ce3ad52b5d22b8fe747299c6362a

  • SHA512

    c1dcbeee0947f960abdfaeb00fa4683f040396a8f164e1a7fffe79160e47026b3e09607a83468d4daf1647a74b67c70e9dfa567f8aab85a79525a830946021be

  • SSDEEP

    6144:gScrL/4mp8DvWGc/YSlIipBReubLzeh7Yy0DMIdeXijX:xcIyi8QSVnNyhsFMCeSjX

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2