Extracted

• • Target

    826bdfa9f3ec50267e0c2b45d02103ae_JaffaCakes118

  • Size

    936KB

  • MD5

    826bdfa9f3ec50267e0c2b45d02103ae

  • SHA1

    9ab7693cb80bfd5d63747c3ae5ca41fcfebe5624

  • SHA256

    f6e9a22a5af683f79a51245a05134c606e3a4a0707dff56ff08c331bf955b915

  • SHA512

    84a6536b7357d266c5bda4ac33518c75e3da5d799afa950687c660b3fe38cad0da0dc2490ada2516c18a1e706597ad9ae39e0d4ccea021f7cc4bcbef4429aa61

  • SSDEEP

    6144:6bK+/lzBE8Aw2adVpAzrSBB7TYBDevrIIqYdq5+EgJ8iY/2qSkJOYxpnD8hY5aum:6+eVrZXA0E4Nxk5xpwqauoTmQWWugeE

  Score

  10^/10

  cybergatevictimsdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2