Extracted

• • Target

    fc7ebcf672c4bef183eb7e5ff8323c16_JaffaCakes118

  • Size

    598KB

  • MD5

    fc7ebcf672c4bef183eb7e5ff8323c16

  • SHA1

    5d88e4b080d1a10366db53566071ed39bc12324d

  • SHA256

    50e73a1b331ab7604aba2fb7b641ac4e26f4fe4b748d69c5b7a87bed4f529f18

  • SHA512

    a37f86c70bfdabf47f037c27d9351fe4ae5882ae02ed5400a7278b81a716e1e286f2b78b7102dd943c074716877dc16f2818a0b28bdcd166ef0c6cf463df3c76

  • SSDEEP

    12288:QjkArEN249AyE/rbaMct4bO2/V6iW6MJsxtEjxAonkRmm6ifbEr4mDyaispWi4:LFE//Tct4bOsoTIOjk56AbErlRw

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2