Extracted

• • Target

    d47ade5c45692f4dcbba652462d6898e_JaffaCakes118

  • Size

    830KB

  • MD5

    d47ade5c45692f4dcbba652462d6898e

  • SHA1

    507c1af16ec9fc321c08069c899678c28141b90a

  • SHA256

    963a2c69846ddbf70c86298da5f8f03d47bb5737d1581721f05527c3cfe0c2d5

  • SHA512

    45d4341a4ad62a879a647297d348638b458c2e8d504a0e6f8484a5aa9baf613f4cb02461130875b14a619ee2c006628293becead0fbb52214fba329194d255b6

  • SSDEEP

    12288:z9VLm3iSu6gVWbAB5xYdM15GJadv3mG9vyP69FfaC6YzS4IE/BI1d0Pq4Rw/Vh5B:pTIy/TVeVhGjwM

  Score

  10^/10

  cybergatelookdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2