Extracted

• • Target

    JaffaCakes118_291be206f75f3e562afdb9af486d1968

  • Size

    1.4MB

  • MD5

    291be206f75f3e562afdb9af486d1968

  • SHA1

    cf343d4c9276e089ea4cc58a69ac79dc6c29a01f

  • SHA256

    2339b636a4e7f44aded79132764608af84c1b3aab67d77bcbb7d49584dfa30be

  • SHA512

    e6d747697901aca5a74be7b90478e8cef6775399e9bc20d9316db9ac0b02edff892db2d1ff0881afde641f0d36cf90eeddbab937044c9a59bc016aaedd6e7606

  • SSDEEP

    24576:OAe9c3onfsbBWt76z2ibhAb/ROtXbe/hJzAQNAV3H0W/5A7Q7z9Cl:OMVBeUAdgbaNW0WB7e

  Score

  10^/10

  cybergatetestdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2