Extracted

• • Target

    JaffaCakes118_7adf4f28365de0e6079041df43c12ace

  • Size

    296KB

  • MD5

    7adf4f28365de0e6079041df43c12ace

  • SHA1

    f621dfee15f80bb5f1eff21c7529bcc01f48b96f

  • SHA256

    f53167dddfdb232fe47a72fa07cfdbe5cb9d8ef2255e12730d9af489d8583e7f

  • SHA512

    9fafc23c4b68f6edd827022175e275aed005f5c4deeb4a2c42e52f94f18ddeb7ea58d0a555d1b4b43a8b1359cea887eb34f3e5bd788c28a4949ff1c805cd866e

  • SSDEEP

    6144:NOpslw5hdBCkWYxuukP1pjSKSNVkq/MVJb:NwslwTBd47GLRMTb

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2