Extracted

• • Target

    1bea33dcc7ecb843d853525e124a1697_JaffaCakes118

  • Size

    501KB

  • MD5

    1bea33dcc7ecb843d853525e124a1697

  • SHA1

    40a96afe47bd2515e7f6fedbab3ecac6ac571371

  • SHA256

    81e210d7b29d3f1374376d9bef13a1ed569fbc6962597824ab7ee03ae1617578

  • SHA512

    9e57a2132553d72699b7ebc84f2a82a49ba3167396f020fbaa9701a176baccb173f5c25fe308c08edf346453398f4f94283978f50dcbc572bd14458842a5d55a

  • SSDEEP

    12288:3809sFarQCjkwaviWDYLrthAZPsc3JmvWym11jQ5IX6bYWunZc769k:M0zUcaKWsLJmOc3Jmeym1176bwnZK6W

  Score

  10^/10

  cybergateaaapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2