Extracted

• • Target

    51bac9a4b6011e88ad3996f90fa5017f_JaffaCakes118

  • Size

    2.1MB

  • MD5

    51bac9a4b6011e88ad3996f90fa5017f

  • SHA1

    6534e4d4aea01a9be11e35fb7c2c17ef93c0fc09

  • SHA256

    662f91b3367f615d1d007cfc42d9e2ad21281beabf4266bd5fa444008115fac8

  • SHA512

    75f2d111c20ee9908389bbf6e4f002311975e80333b601d31dbbe4a5a145f13c20f9168041f3b91de1d1c095649fff195028f6d88d53dc7cc7cb480dc13c4c13

  • SSDEEP

    24576:SsZAZUR9t5MgkrSbqrIVcCLLPxfApro/tBhN+xbmncxZMeF8oNafBGou6yRGnpBM:1ZAA9AubSIVcCLrxf7No8oh6yROf0

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2