Extracted

• • Target

    86e0ec3deec411e1b6ece3acac13ec2b_JaffaCakes118

  • Size

    477KB

  • MD5

    86e0ec3deec411e1b6ece3acac13ec2b

  • SHA1

    0c267880ae94e8e3acfc72b5bff9c28538feb357

  • SHA256

    2ec76a0907a1cab9cf946f747d92c0b6ab83346c7b03ba1ecadeca5554ef9eac

  • SHA512

    b6656ba5fe63c27ef9d3420ebed80ad6172327d4877bbdd2cc0612e01bed73d7a3c62407923324a3ac3b888f0a258d7d97b9e7e156f2e8f81becd95e255edc33

  • SSDEEP

    12288:HvIpcPhUqDhacE4o7/QTzeDFwWGP9rsqXYrsrAPKO:Hvm6Uq1aRizTj9QqgEE

  Score

  10^/10

  cybergatekurbandiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2