Extracted

• • Target

    JaffaCakes118_8466c794bdbb21177e42dd75020a20ec

  • Size

    593KB

  • MD5

    8466c794bdbb21177e42dd75020a20ec

  • SHA1

    1f38ff00fbaa11a09b8f6c8980107064a7d5ed93

  • SHA256

    63fd1a366ad0b6e9926faa6a8be51d4b0a09f7feabb49ddc31abcac83dd73eeb

  • SHA512

    9c0e756c7b3beeb270f716965887ffbbd8dc560fd811d40ecc289d0bf9665c6d5f67b425e3b667a002e3b36c6d125f1bf227ff7ecedbb3cdeef4fd86718dfe19

  • SSDEEP

    12288:5LAxHyCyxs5mhLUl1XT3OZ7cNE1IbWmjfz4KPhMzXoe/qBUfSOEpBf:lAxSCyx82I7jLMjoeyWfX8J

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2