Extracted

• • Target

    68ac7dd28d3adcee7510b8bd94d1dfe8_JaffaCakes118

  • Size

    906KB

  • MD5

    68ac7dd28d3adcee7510b8bd94d1dfe8

  • SHA1

    85ee89c214393efc62e4e99fcfa8a51c14e06687

  • SHA256

    4f617ca6ab78ba69836948ae88923c3c640a0ad1a5a733e3e42f163523e294e5

  • SHA512

    bd95426587386b2b78a5bb9f3830939822d95ec7603c8c915395ea1ba423cd0d1fd40f265542e57bb4270b5912eee9f97fd73984d2ed998a8aa3d4383a1fadf4

  • SSDEEP

    12288:QZ2z20oPp6eRT+PO2CRRzeG5hdkKrLnYR2DlT8NCfnT+Z2zkPaCxI:QZ8kT+mx/zxkRgRdb+ZOkly

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2