Extracted

• • Target

    JaffaCakes118_737975fd36f3da7557ecd9f4b9741392

  • Size

    276KB

  • MD5

    737975fd36f3da7557ecd9f4b9741392

  • SHA1

    bc10fff1b220dcead22419a373eeca8534dff20c

  • SHA256

    2eddc6ab440e06b6f080976135cbde062bfa2daa77b0aeac76c2d630cdeb6a27

  • SHA512

    9fd87af9de29c6ff8b840f20f43696dcba3082776e5c4077a02a957b7d1c329b11ce77bb00bc5f59bbc7775feffede302263b3c82e20d469b1082403cb7137d8

  • SSDEEP

    6144:v4ABF94rpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKL:gUxGLE0kuGnESBL

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2