Extracted

• • Target

    JaffaCakes118_721817c282478d093a7c553f25c4b950

  • Size

    284KB

  • MD5

    721817c282478d093a7c553f25c4b950

  • SHA1

    0958bd3ba54f28b3c557645d3069e0bb97ae8a2d

  • SHA256

    ea1c14079e29d62ff48cfb1fbde60187c290e1749db16565d9f6f6c3ac1737dc

  • SHA512

    52fd29b8cda31eb5dfd566dd86fdba21c65ab4f3e6429233c79ce3a597987efd999f1b2472eb6b23b1231004c5ee1fc7d54230c54150c4c47242cca5ea7cf3d7

  • SSDEEP

    6144:Lk4qmqZTOqYomXvFEyrj2kZNT07rg495dBNXn3Bh7AIoO4k2:w91Yo8vn/ofg49/BNXvV4V

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2