Extracted

• • Target

    95c548715eb68329408a910636e5a4b2_JaffaCakes118

  • Size

    660KB

  • MD5

    95c548715eb68329408a910636e5a4b2

  • SHA1

    50ab9d851ec409fe211c9c9781a50f98c40ba2de

  • SHA256

    ff8da24b3141114ffc370825df4f5178ec90abe3a986f25f5b35ab38484076f3

  • SHA512

    160b738ca8d28f35b34158c2fb1cfff0d82d74cb53071eb70ddd699faecb289e3230fbf7648a337e478aa2e4a2a0c846f9148aa481f960530ecaa98dff36e968

  • SSDEEP

    12288:Cjtju6APFo38dPbUpLbQJNBWQ4ewnzBSxlDW+p2kYE4G+sootGS6xg1C/6Bo:EAPq3SbUeXGSX79YE4G+TQC

  Score

  10^/10

  cybergatearte-de-invadir é nois que trah_.discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2