Extracted

• • Target

    19272e2c286dfd41f9f7186dbb6e47e7_JaffaCakes118

  • Size

    563KB

  • MD5

    19272e2c286dfd41f9f7186dbb6e47e7

  • SHA1

    e918baa49621689766de420163b061a12c1c6f04

  • SHA256

    1dcc1431af7fb0edee9c5e4dc6f4937c21bac48851fa63503398d95a176bee38

  • SHA512

    0c6beba7d3bea95d4c129802e4b2f6a9ccc84baae645f297cefee11392005152896522828d9b9534d4a4ff7af656ed6b148e8cc511a2ae02b160be43ad7c67b8

  • SSDEEP

    12288:YBMmKGnhDT+JAxnPdZ200IOKUhSMRRkdfwBGkHme0nuKWvTnB1wX:6MmnDCMPH0IOKUhXRcrkHonuKKTQX

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2