Extracted

• • Target

    JaffaCakes118_760b62101536f1d3da179ac032380cb1

  • Size

    871KB

  • MD5

    760b62101536f1d3da179ac032380cb1

  • SHA1

    ecc76f5a85c5735321e5a7ba6fed3282dfa2956e

  • SHA256

    14387dc1c2ce22f7d9f3b0676e59a8f134856a5130398c1f4c38f91b16ef0336

  • SHA512

    eb2bc30be9ba49a8742f4b8612a4d5d8956ef710cc3f6e5b351e5a5f867e4aa08f0fa857353afc093910ce42b840ff1ac6f6c516a570624dc3975ad4e13139c3

  • SSDEEP

    24576:BalaUV3mShJfVh8yalaUVamSh5fVh8AxdvVpL0tJT5J2v:4aUV20JfVhUaUVB05fVhf/dpOTu

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2