Extracted

• • Target

    0e04b746efc5df53ccec1fcbd86f0aac_JaffaCakes118

  • Size

    522KB

  • MD5

    0e04b746efc5df53ccec1fcbd86f0aac

  • SHA1

    59198c81b9e2fc9a0738f6394bb65e7b82cb740d

  • SHA256

    d505e3ab20c06778d6164e70ff692f625cae4c013805f885e7cb737c7a6f6764

  • SHA512

    d3caf4af51e177b4d51ac32cb0056a943250c8de4ef5cac3799385c56e92f8cb7cc5b077ac540cf739333fba382961207bc790fa485ec549702dacc54ff2e831

  • SSDEEP

    12288:n+GOjcRw0DYuEst3D927BESqwa7MueApF6BU:n+GOwRw0DYuEsHMBESpa7Mueu/

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2