Extracted

• • Target

    7f697120c92675f3a449d8debf584ee1_JaffaCakes118

  • Size

    660KB

  • MD5

    7f697120c92675f3a449d8debf584ee1

  • SHA1

    f28edac73d88c809f366355e25df1e2c2492af39

  • SHA256

    6dafccdc9a6d5f44f3488b3ad088bf212569264790e85921bf38b4d91ba53b72

  • SHA512

    ed36019bdcb9d9c4f5d051292c751c030dbade49d9ad6304eedb608d24cac37554cae66c4178d7c93805231e2965408144647f581fb8d25802feaadabd1594a9

  • SSDEEP

    12288:NHLUMuiv9RgfSjAzRty9jpJHAoe3Zq1kcmq48IPr6z8psU8t+rH+i:1tAR2X2qOGIuz8WId

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2