Extracted

• • Target

    JaffaCakes118_7f8a0deedd371879f66c2810e211fb4d

  • Size

    324KB

  • MD5

    7f8a0deedd371879f66c2810e211fb4d

  • SHA1

    0d0ebfb2416af61d06861cbd5e30a329017ff7b7

  • SHA256

    0838991effd3e928bbf40d70bdc78db89b275529e553eefa486f7a05384cc5b7

  • SHA512

    49096e1625008ccf8949473a3ddf0860f2aa90c2f9d8935208219d48d11d306835a60bda61b6ff4ac20e3e3dd95adc3d7267edf5d217fe84ae4fbec26dcdaef8

  • SSDEEP

    6144:Ek4qm/76XNeiwpbD7a5Gy8naCOWnZHcO75SSXbuM8JW1X4CH9shJD35zcm:H9ZXNCFmUdnWeRbuM8JW1X5uh53am

  Score

  10^/10

  cybergateteeeediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2