Extracted

• • Target

    JaffaCakes118_7c50acad9b01b6dd8ffd3f0038e1a2ac

  • Size

    353KB

  • MD5

    7c50acad9b01b6dd8ffd3f0038e1a2ac

  • SHA1

    dd2805526c7f3742f294e0e0dc6b724dd643ba0e

  • SHA256

    2f66d0872cbb0632a079c5b8220b67bea70a8d7f3cfd79bd20dab535ad53aae7

  • SHA512

    1c2d44dcb93a89e4772273000388038d0890b8ef118702a6ffe84679cb5962aff5f47e67cddf8f4831a4cd8fd29c64703454a837c4865ede2552621d979f065a

  • SSDEEP

    6144:ImcD66Rb5JGmrpQsK3RD2u270jupCJsCxCBIUF:BcD66UZ2zkPaCxI

  Score

  10^/10

  cybergateöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2