Extracted

• • Target

    JaffaCakes118_5a556792e57618242805c53bcc758868

  • Size

    428KB

  • MD5

    5a556792e57618242805c53bcc758868

  • SHA1

    37995730326297cfbf9bf0e7c0f6891c56028e03

  • SHA256

    0cea9fc86f3f27b77ede0f174058b66cbb19b1ac3b2f4071f62b84ba0849a503

  • SHA512

    dc2052e0d1680d0e2432a034d578c81b7b479cfa1514a3b5fd6a07c16d033c3296b56ed829ee9ee09bd39f31c8661c698a6cdcbbe04855cbedcabf17db795439

  • SSDEEP

    12288:xuMwyBi8vvrHxVPKyv2m77sZB07FxObO32q:xHwL8vrx52t07FQaJ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2