Extracted

• • Target

    JaffaCakes118_74b689b53ba631d667bc87f389b4921c

  • Size

    754KB

  • MD5

    74b689b53ba631d667bc87f389b4921c

  • SHA1

    8c9bb41a258373dda0e580a6b96b6b0188cf476a

  • SHA256

    6a6f511ecc3212b06a48d0ed7b7dd1b041e5e8b6bae1c7b4d6c77565162889ca

  • SHA512

    228743136f243922e215ef0b5856d3d554cea79fa9136392715be8f2cbe46a6af3b01a6b1a486bb368b982327257192b7a634bc6327c836595edd13db41789b7

  • SSDEEP

    12288:R4dMRU/UP4heFjLDFtooS2UXZRY49SA7GI/p7a6o2Mhi9v6FAqGr8iZnkNvEMCQF:awU/UwhWvwXZpSRSJo2xvWGQiZkNvEMz

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2