Extracted

• • Target

    f5bf9e39e62fddba5449a9d3492a7589_JaffaCakes118

  • Size

    368KB

  • MD5

    f5bf9e39e62fddba5449a9d3492a7589

  • SHA1

    c83b6de622ca498e7b9c1d69695f98deb00bed75

  • SHA256

    6c89d97f9840c41933e18427207594577e3892454730256787568d3560dd3fde

  • SHA512

    2cab4f96b7e4d0c1f324d2d81f7d405f6bc53fd3252efd266d59fa3db420eebe540f6483c9255e379d21ed4a5869b0d51c4ee3d929c4096a771e01ec8768494f

  • SSDEEP

    6144:JyZGUyH4Aw8HFgFwum3WH5TERyABvebS3Ds/5hp8HzAOBoZUB4H:sQ4EOFwuX5TEkABmAD7HzAOWKSH

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2