Extracted

• • Target

    JaffaCakes118_831566fb9b1d32793cdb488a1483c45a

  • Size

    275KB

  • MD5

    831566fb9b1d32793cdb488a1483c45a

  • SHA1

    5c62dd434337e24e547ccd0ab87d0c101e666235

  • SHA256

    ca06ead90e3bb99b568f2fbeb3cd95c8ac903055745bc04caafddf781fd7f2db

  • SHA512

    68b53cac0265b17960ee627fbf61637ce59bcdd198defd983de9584be2f53a08be1686c8ef446fd5889063645c5f26d22a0ec474a2af992dd4bcd3a0b9031135

  • SSDEEP

    6144:vxJsGLncoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ+:5JsGA4h/xQp6+tqOYy9zo0N

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2