Extracted

• • Target

    9fca9b18cac68e7d6154a7fa6a78dfe5_JaffaCakes118

  • Size

    6.6MB

  • MD5

    9fca9b18cac68e7d6154a7fa6a78dfe5

  • SHA1

    f51aa529671e4c7312dacaae92bc00270f6e4350

  • SHA256

    303ec9a3ed5f4235ce7ab5a0c97f5b9c80596df4fb5e75a0a8848cc6e2b08395

  • SHA512

    3cd3b63740552381f25929f4a0fb29ce66254f323f7a5c0be76e99120473cf3db579f1355f1315a820b5c19db6114663aa85c6b3e9f360a8b79261176ce05086

  • SSDEEP

    6144:2O3WiXfjoS3G1Gkp9OsCV7N7xgB6zP18Pc79cqNe1KW0aMEcw8X3:2PwWtmjVJ6B677eKe1sLLb

  Score

  10^/10

  cybergate0504discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2