Extracted

• • Target

    3768ec8917d460000ade0d626981524f_JaffaCakes118

  • Size

    296KB

  • MD5

    3768ec8917d460000ade0d626981524f

  • SHA1

    ba0df1dde3aac7dfb4cd6c9a6280e6d6e2135d71

  • SHA256

    9beaeba3289bc905dfc4db5bddf469798b1cffd4f7b6879c66cc3c23bb6132e0

  • SHA512

    e88a8a3806813a0e7a9f9f9f931df30729338f21689168d6e4de29c0557dfd825c0e02ef0994e95356ae626400cdf9363bc858b5c9f3d3dc2c567d8350d16668

  • SSDEEP

    6144:roP96XjZEqbScXE1SMqCwzcOP1JMuYM5jp518++9We/3mEiv:roV6XFEMXXE1SGO9RF98+6WemEa

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2