Extracted

• • Target

    129a7aff2273b15825bfa708cbcca280_JaffaCakes118

  • Size

    492KB

  • MD5

    129a7aff2273b15825bfa708cbcca280

  • SHA1

    fe6e8488777f9ecabf5176834e2e1c6bb54a3b3a

  • SHA256

    021ba5f3b8680a65dbc8ee7b344a459472525db30edea2af3a6aee1ecbb8912a

  • SHA512

    8c0b29ed5d61692571d93a5b0eacb204b82ae0ee923fee1c1efdfba8368565fa189bc7da3c61c6380dc3f85decd860c38a57e69b7b6ec11624d5526846a1bacf

  • SSDEEP

    12288:dcfo9Vu3Jcgo2zbMtCN9Rs3jhukVRj84+15mh8a:dcf0gk856jXXjRMmh8a

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2