Extracted

• • Target

    JaffaCakes118_83798ff76f76b45e817bce55e24c4d1c

  • Size

    816KB

  • MD5

    83798ff76f76b45e817bce55e24c4d1c

  • SHA1

    d2bbc123d880be47e6a526a33336cde727660a96

  • SHA256

    39615ee3e2af1496a389e67be3543ed99e88ff9f8dde30ef1b1933c370a45aa8

  • SHA512

    d3e52c4ed756d0838986d357837426458793fd63583016983a351f6ffd0a4a6064f6e1bb504fef6aa859f9a628959fdb83d66b0c3213221fdfd60938b97c1e29

  • SSDEEP

    12288:FnCf2JclWSNvk9Q/C4JxHxVGtHM+HkFi4EZiDeXPo2QvK57AwRLYxaYbdZxdCUE7:Q2JuWw4WEPWZw9Y

  Score

  10^/10

  cybergatedemonicdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2