Extracted

• • Target

    JaffaCakes118_a20b7aaa40dcbf57f0fe79a86a8e9d03

  • Size

    294KB

  • MD5

    a20b7aaa40dcbf57f0fe79a86a8e9d03

  • SHA1

    8827e39fa7ebc0f45920c8754ebf1faac5d4da0d

  • SHA256

    832fbc257f49fcc849999b4f3b2452fc3636203765780145c59263d8ef305ae5

  • SHA512

    7b70983e43e98796a3e9771a4bc09b3665176c8fbc3f5a0024fec086d09068b5d608d35613cfaa753c2d2acb33d2a08408f0c31b1d5cafee9d2047f4f3a4121a

  • SSDEEP

    6144:WdWWSSmIbuGR+mXo54aSNMsQ8pi8lueYC/AyPjDKHN+SlrFEmbAZNyvx33v:WMzSsGLyOGsQT8lubyPqHNNrmmbAvEP

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1