Extracted

• • Target

    JaffaCakes118_85dc8c35e8ee10ee0253e05b641b79e7

  • Size

    388KB

  • MD5

    85dc8c35e8ee10ee0253e05b641b79e7

  • SHA1

    6bff5bdfc1b7158bfe9a2723d81fef3bd0952e61

  • SHA256

    a7abedc50829251d1c774fc1f576569ad81c147a90c1078fe4970dee388c1172

  • SHA512

    8cd4134d3949cfd1baf112d0c973f8a46853f5756ab241a89658e6d79ee696e9d92983da72231081145d02707cf129edf8acfe8f2d69d865b7334ff6fbcda7e2

  • SSDEEP

    6144:/q34tDV97JH6UsRpy/0XQdS4df3DVFQ8OFY6Sc8YWE2kjx1DuwBTXrsoa:yItr9HYpy/0UNND/YY658rHo1iwdXr6

  Score

  10^/10

  cybergateikram-putediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2