Extracted

• • Target

    95e15022c8cb16256400a9375f52d8e5_JaffaCakes118

  • Size

    337KB

  • MD5

    95e15022c8cb16256400a9375f52d8e5

  • SHA1

    cd13f907a37810cf533e66b29623f5565220ac18

  • SHA256

    5d7596a603999a3a0d76ef4c40e3029e54296c25a022dc211fc2539bd4ca3597

  • SHA512

    17def981b55c19b09ad12aaa8fea6a3ffc98429a74ad21ebe99aeba17c9c75f4bafd2dd8cc48283d53299bc95d8c08ab6227f69bea8f767c332bd8df9b78575e

  • SSDEEP

    6144:SXEuCwaXVewezwwU6xn49tJ1nkfi9fPpUdBws1SKwNTC:qCXlewG1U69cJx7faBbYI

  Score

  10^/10

  cybergateremotodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2