Extracted

• • Target

    a12972666da2e40b21c11a14f12e84f3_JaffaCakes118

  • Size

    559KB

  • MD5

    a12972666da2e40b21c11a14f12e84f3

  • SHA1

    19a0e91c7d6567b98daf8f33f4c8f7b349dbb33e

  • SHA256

    e98b383d05f55502d254beb6e34c734cf92a74ea385c57b286b891891a4047eb

  • SHA512

    16a8820a2072810aa0522aeab0c449bf0ad50c69a5d819e9a2871a219634ffa3b2fef688e4dd03aeb322a68e18216f9d20144b30294c71bf6e27c9c5ed496987

  • SSDEEP

    12288:j0GVpWoh84xjjrqTxhtvUgFtPZ2zkPaCxF:jhVpWgz9vqlHZOklX

  Score

  10^/10

  cybergatexatars.zapto.orgdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2