Extracted

• • Target

    31101855780f6a6eb64c848f860f540b_JaffaCakes118

  • Size

    317KB

  • MD5

    31101855780f6a6eb64c848f860f540b

  • SHA1

    2f67c34cfa190a0d21f4d2b5098912be7bc2ba1c

  • SHA256

    0062f88be716d94eee46acf859de4975fbf7922a93ad17f620cf62d30790d190

  • SHA512

    defa7c08dcb58ed582d7841270f30810764e572606d4d102618fac5f094a7c7dca6d428990666924853b34317fb86ea0876eebd977680771cba519db87aa27ff

  • SSDEEP

    6144:4CyrCy8kJnusDZApSnRkRy4Y1B3RF3V8EGd:4vrv8+n9wSRkRy4Y1B3Ed

  Score

  10^/10

  cybergatemanpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2