Extracted

• • Target

    JaffaCakes118_818b0c1facf967eef3b5a77832b378d3

  • Size

    410KB

  • MD5

    818b0c1facf967eef3b5a77832b378d3

  • SHA1

    02c323f741fec84298532f7cdf960eb26eba3cf2

  • SHA256

    39e3a040d1ab51cd6153aa4f1d1156bfe8644112898739d89773c213a628590a

  • SHA512

    bb59d7f756475cbf7ea1e617e63fef14c4ec3487d0bd5d780f853daf849c08a445347fd71607a26b0e93fef593cd8721eaab25044c97524f9b191baee01781dd

  • SSDEEP

    6144:8OYO7hWUG0Knz23tqx24zGRqF8reYh13gx2H0pCEbGrcuKJ7uLtw71u7mOl:JYO7A9C3qbzyq01QxR5QchJytw1Ol

  Score

  10^/10

  cybergatemonileckadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2