Extracted

• • Target

    a1c545e6db7f77e952978bd0d70d98aa_JaffaCakes118

  • Size

    317KB

  • MD5

    a1c545e6db7f77e952978bd0d70d98aa

  • SHA1

    bb01abe8165903dde10e10517463732933b41b6d

  • SHA256

    01d4e68b1d57d3b3cb41fd0254d0ec8c691386e3cebb6461a8e813c754dac9c7

  • SHA512

    7d285c270f9ed020dd7e42cd09ea5f69db3c7377560117b60309fd10468cfacf341bda214e6721c994f68ed909fc8ba8c682ce5479fe24f723a99dbf02f50ba9

  • SSDEEP

    6144:Fdnx88I0pGp+CY/Z/jDwNfUJWdjZeAENaA7RTKeGaHKw49sy1jgFiqf/iu:rnx88IoY83KfUgjNA7hKyqjTjgFiqf6u

  Score

  10^/10

  cybergatecobaiadiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2