Extracted

• • Target

    JaffaCakes118_5d2779045314dc6c1c34b9de1577b91b

  • Size

    721KB

  • MD5

    5d2779045314dc6c1c34b9de1577b91b

  • SHA1

    c3385bdbca7746104ae8a47d3afeaff816a3bd21

  • SHA256

    965d82f1f39f9cce5faefda81271b575ffe5c80add2677603bbf9a86f6a9da0f

  • SHA512

    7f11cb2946cd65bd329e2db55fd433c48108f21ef441d889ce69a5b54e2106fdc1d575acbd642a2895f99de8115cb3a3d7392d2cbb60b26814e670b401602677

  • SSDEEP

    12288:pD68wWToD68wJc0Z5HEoJ0s5s1IhaDthxdVQ9gws3FeUjpiZVjTIj6zLN0836dos:pc0XJvs1YaZhxrQy8UCVgj2K8DzgUv0

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2