Extracted

• • Target

    5fb84fb89214d76f21d9f74ebffe997f_JaffaCakes118

  • Size

    647KB

  • MD5

    5fb84fb89214d76f21d9f74ebffe997f

  • SHA1

    605d7e32370e679437fa25f1073176a84773a1f9

  • SHA256

    9fde1d47668711092887d814fddad93fc75c1140973d614a90f85eda2ea15f2e

  • SHA512

    fae73ef38d64ccc2320fd2e5eb3ba0fb961599b4930caf78d01297b83def71cbbebc56dc29533e6081cedf97d7b09cb8ee6f478dbefc20802e2f14af7279b03e

  • SSDEEP

    12288:6HBozN/AHTPfwpzO5xFpiEB5r5mMy8Xf/8FUXWRGzhOx8bUJZ2:6K6HrwUXJ1oSMQWuhWS

  Score

  10^/10

  cybergateyenipersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2