Extracted

• • Target

    30d41c84308dedc97de3b19247c7ae70_JaffaCakes118

  • Size

    667KB

  • MD5

    30d41c84308dedc97de3b19247c7ae70

  • SHA1

    c1ef1570b6dcaa3fc53be077bbfabbc0c74e45f7

  • SHA256

    bc853f835c71302511ec999fa8076d7fdae74e5c170dcb2037f38e6a73befeab

  • SHA512

    566e07d53553dfff6bc185b571b0e4efa67f87caeceecd393b3928aad614ad957f73b36dbb3791f39fe4907632365156b5d58938d7157d65bab1ea653f896839

  • SSDEEP

    12288:go05EcZ7t/xHLIzAfscp7yy4k8u5nZPEWIyIG08LHDXK8iI67:golcFtfsJyN3hE18LHDXK8iH7

  Score

  10^/10

  cybergateemilidiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2