Extracted

• • Target

    2b48becf815c20c289d32fb8eb8cc7f2_JaffaCakes118

  • Size

    405KB

  • MD5

    2b48becf815c20c289d32fb8eb8cc7f2

  • SHA1

    03adb9b2e9c96681b1e593ed80c7ecf9967cc621

  • SHA256

    010d0a9549776bb470ca5acaa62e3ff23b66356f16be006d00af731932fb027b

  • SHA512

    8ee6fde3a7f2303153ab9f7145e15e5f4a7039480f9ebe33bbb117ecc3b5592a98966222e915a6f394dbcb488df19f72b6062a9c316cd291856f311f1b253851

  • SSDEEP

    12288:vxbKLvWnmc+85UImXNf60kOy9st1t9vN:ZEvWnVH5FmXN8X9sN9vN

  Score

  10^/10

  cybergateadminpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2