Extracted

• • Target

    JaffaCakes118_7da8d54f6b23a5f11d6e9244092e4b29

  • Size

    363KB

  • MD5

    7da8d54f6b23a5f11d6e9244092e4b29

  • SHA1

    e5a85e1672b93b65167797914c60b7fb6bcb512e

  • SHA256

    982554c08f736174969e2b626f245eeedea087e10cb1e1531a5c06eb2a63f3ac

  • SHA512

    6ad97ed79889cdc8907d7f6f46df1a2f7efec54146e95e1f380b7ba149a1cb8ed959fb28468e55e7aa38e142b443b06ea82e4ac737344d16785b7b8ae34061bd

  • SSDEEP

    6144:2YUr3DBAMTrQGCZBJIodCdqgddPZfZC3WWANZC+uvfhyXWliqr5A/538:2YUqIRCZBWykdPZxC3KZ2v5gW8U5I5s

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2