Extracted

• • Target

    9fc869fa531de1428f75d24998429eb0_JaffaCakes118

  • Size

    360KB

  • MD5

    9fc869fa531de1428f75d24998429eb0

  • SHA1

    539329815cc8930d2969071404ef23124d2455bc

  • SHA256

    c74387f281d4993643333271fdaaa38ce99bc4f8c71b9fb5bf5452effbbcf2d9

  • SHA512

    ed3f447f2864328ad8df7d023774d3d748d66f8cebf6f221ee1f9f3b429b2911a9981aa6fa57fef834bbd45a6026ca5db799f22abeb19ebe07b62a0072791ba2

  • SSDEEP

    6144:kJI4PMbg2cZ8k+M49woN4D5JdS9R6NWv9Eqm+IvO1eQfzgRoNTkiew:Hbg2c7+MatNkuRXv9GW1eQMRA

  Score

  10^/10

  cybergatefeodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2