Extracted

• • Target

    8abd49df9460813e1263ad65d09c870c_JaffaCakes118

  • Size

    1.4MB

  • MD5

    8abd49df9460813e1263ad65d09c870c

  • SHA1

    989b98340c83bad5a3440933105e09453d5fe12c

  • SHA256

    f047aac765bb9fc43f9302b5fc3670ac6f629af24e2f632ff134cb31b136dd0a

  • SHA512

    75a118930ca33aa2d17a252a78eed5d794f604f605df23c36525bc38ee3a7ed826285cd4ca3c97fd99a2a608c26f77b32088ef73185d45a9f0604e337bdda2e4

  • SSDEEP

    6144:2O3WiXfjoS3G1Gkp9OsCV7N7xgB6zP18Pc79cqNe1KW0aMEcw8X3:2PwWtmjVJ6B677eKe1sLLb

  Score

  10^/10

  cybergate0504discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2