Extracted

• • Target

    JaffaCakes118_4a5b0636aa9c9c27a596d9313b5331f9

  • Size

    284KB

  • MD5

    4a5b0636aa9c9c27a596d9313b5331f9

  • SHA1

    14ad7ff3093c456575e86b6249e7f1441ce8fbcb

  • SHA256

    9e56abcb0706c53cf290074df5f50ce8fc058b41ca5d4e907fcf6024edb29f0e

  • SHA512

    9343f33cdc97a71bb3d80b33ad9004043cd57a2c0b4652b1737cad5ca37cea96eb9f9e02fadb9ed80d16eec3c4f901ac09200c3b08954a6dff8693e8ff96528f

  • SSDEEP

    6144:Ck4qmFnSdyAc3rdBgepxcsije8l0KLDoupjPc91EaaI1a:99O/BBg0+qn6xKEaaI1

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2