Extracted

• • Target

    JaffaCakes118_6c201d81a7d635434d7bcf1c333a898f

  • Size

    390KB

  • MD5

    6c201d81a7d635434d7bcf1c333a898f

  • SHA1

    7f639d0d969a2b9e14f426e306812a568b041059

  • SHA256

    9c2729b6d424d14f130b8c0f90d8eb62f67edbd590230c950d5aa61ef0a72d82

  • SHA512

    ece8b7e04f993f381b6508944176f714836cc6fa9be408d373f3479bfa230997c768cc5aed7a2dabc701e0ac1a9eb8bb804fd1d609c8d53e4d7545954c7751ed

  • SSDEEP

    6144:pZZ7VkB5riG3txHTzrs0fDVs5Mhf/lXa6TF9rD2BED50LD/kcess:n1VkD1L/r9fDVsOpT/F0Lbs

  Score

  10^/10

  discoverycybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2