Extracted

• • Target

    2f51db8d6e6e4609339a6768be130b6a_JaffaCakes118

  • Size

    211KB

  • MD5

    2f51db8d6e6e4609339a6768be130b6a

  • SHA1

    79cdf8e6b1f6db8c6a8a4da4b54a820116fcc658

  • SHA256

    e1ed42ac58eb71b9f54286b341eebecc53c2cf579e9b7e3b8c8dd88ed8c79fae

  • SHA512

    f0f16406f6cc882644de7e13761030e3579761b31868c2b88494240123fe1fad65702521770281420a6dc16ee4a9a8de601947f476aa8f30efb5cd3ad5b32ec5

  • SSDEEP

    6144:RMRTZrb96Fs1tYQlgKTH41tzauGa6JyeFmm:RMRTZr8Fitd+knuGaEFmm

  Score

  10^/10

  cybergatevictimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2