Extracted

• • Target

    JaffaCakes118_87c0165d80dcb59f6b37840ae4f167fa

  • Size

    267KB

  • MD5

    87c0165d80dcb59f6b37840ae4f167fa

  • SHA1

    7e4eee49d395160d4f1efa43335d9c49c0b2a9f1

  • SHA256

    2461e4b4ce374b7d48c8a8110e37cd2c0114c4718b0728956244573d18ce5559

  • SHA512

    515a9c4db5ab2657bbc7e8c00d4d02feaf5afd8f727c7722d0adf63779b9c3fe677f53a94761d8da5b58e9fb685ede82641d4011fa31e34ac7d97b0a231e1971

  • SSDEEP

    6144:5kTVAEU7Xq/aKDqBM3XjqWr/DZLrACAC2IR3Vtli5N7ZEO6G0rLvRB:efuqiKD2MjvrLZL/97QNGO6bv

  Score

  10^/10

  cybergatelammerdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2