Extracted

• • Target

    JaffaCakes118_620ceb84ec7372ac01b42a03c539fe03

  • Size

    296KB

  • MD5

    620ceb84ec7372ac01b42a03c539fe03

  • SHA1

    51f0a4891b8de4849dda10d9190a94f9e6c117bd

  • SHA256

    914b668d868859feeddce3cc62c7677b9dfd1a62c1bdc3245daa1e05b94d9c81

  • SHA512

    43d3716a5e517b6d1b5b1978284f78de5da5c0e2b213ea05e6c1ba7932984ecc5f0c017a528b51f47a76774a1d34c47302964aaa052e5d7c377651c08624ef8a

  • SSDEEP

    6144:POpslFlq9hdBCkWYxuukP1pjSKSNVkq/MVJbj:PwslyTBd47GLRMTbj

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2