Extracted

• • Target

    JaffaCakes118_69ea99080a54e1108f3320b513e1f044

  • Size

    323KB

  • MD5

    69ea99080a54e1108f3320b513e1f044

  • SHA1

    8153b29e3f2bb582204cbe94d140cc0e624bca80

  • SHA256

    9ff69041c61af491030734a16356f85d59b059d821b7a321c8222a85cb6be94f

  • SHA512

    0aee21a6c41efcc8fac9d2f12a2be12c7016619dc77d5f37e0f0f89732127cfded85cd28b2c9da50a749051cd393cdde4b5f8fe2f2d143f2df7bd44a04ff7fe3

  • SSDEEP

    6144:x4ABF94zGjANpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKZ:CUOkGLE0kuGnESBZ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2