Extracted

• • Target

    JaffaCakes118_61311111b8d370a283a843c8b6419ae9

  • Size

    355KB

  • MD5

    61311111b8d370a283a843c8b6419ae9

  • SHA1

    f52748f7c50c6100e0a0040d4899de5ddf1ee823

  • SHA256

    9104787b82bde8ad2d40f7e7c77ea4303951451b99be36e6f106d547fef89678

  • SHA512

    79261acfdf077a9db0473b6c0297bb862008dd34da81613b0c47f3c488bdfe37ca66e065fac4ec255f8eef9776db0f590f2af6dcb5812a5d327d3679307cbee7

  • SSDEEP

    6144:cOpsl6hdBCkWYxuukP1pjSKSNVkq/MVJb4IixX1nsE:cwsl6TBd47GLRMTbO1s

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2