Extracted

• • Target

    JaffaCakes118_84c8b1fbeeb717c572934e564de714f4

  • Size

    903KB

  • MD5

    84c8b1fbeeb717c572934e564de714f4

  • SHA1

    2609343d195368a5b118e4d5b4587b11680c109b

  • SHA256

    2f5bdc3c1540373a46565095571394adbe591b3b8b11322aefe461111d650d42

  • SHA512

    d5fd6e30e64591cb8f3bcdf0e7e65f93ce3f9331516e6f8560a4124c3d0cd41a568442b04644ebee13582ecfc910a19008ddbe67dcb6979bdb650fc462b556b9

  • SSDEEP

    12288:NBJHa4SSqrzuhQ88jIYSl10R/IqSBk58tKTGPM2Leov6uqoi2W+/gF1chxGZZlxt:NrHaFSIR/998CGPMAHgzmxGE0

  Score

  10^/10

  cybergateviko89discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2