Extracted

• • Target

    JaffaCakes118_6aa36426480531a8c3acac4765b25f03

  • Size

    404KB

  • MD5

    6aa36426480531a8c3acac4765b25f03

  • SHA1

    676ef00554c824ae262471cbbe11ae2c159b505c

  • SHA256

    39fcd34654de4fd0723de2335b1373f394bfe2ee0b2407196227abf37d740c72

  • SHA512

    de8fd822825edc678da8a9b1becfce55120b68bef7f865fd28e9b93dfeca01c3c183feed2414cd1653b493982b9952e8923b88af9caca1e3d8ce208c222f25d2

  • SSDEEP

    6144:pdfJxSR/B8AIvUb2dqXQlL7oAI9qlzYIVOE8RPIty1EAJJbE+Qr6EwZELdy:pdiZ8W2A0cAUIVkRP2AJJwLGEw6U

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2