Extracted

• • Target

    JaffaCakes118_b3017e01146ce9c1d52804a0453e1e8b

  • Size

    396KB

  • MD5

    b3017e01146ce9c1d52804a0453e1e8b

  • SHA1

    e481a3dcd3c6084516df4555a33df21886858e57

  • SHA256

    96387cbd8d2a19ee17124bded3425eb0bc33e2ced56638d8d57eaf6fd0b37e4c

  • SHA512

    630bae901e989a68d011dd486e5b50a66d5b19e8809378bad091f88e744cb0092574ff7b40b9665a89377fd58cd988617fa1204d82f50e6f3dc11e4bd0e20596

  • SSDEEP

    6144:ymNjYuKj/4pTNSbaKoyeuVln3HRC0Upt50VKqttqL3gsYm+YM/pn0qzOIi19Dlr1:7AOnKoyeO3HkbpgZsMj0h0nVn2PG4D

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1