Extracted

• • Target

    a6532db6f6219fe1dc9da7f9d3e2730f_JaffaCakes118

  • Size

    378KB

  • MD5

    a6532db6f6219fe1dc9da7f9d3e2730f

  • SHA1

    08a80475793d86806f1decd6c2e54a3efab9bced

  • SHA256

    16c44c4a7769dbd176f7dcae5661ba3a9dd099d5dfa52ff89133286de287ca6f

  • SHA512

    d2c11932538154be3b34e4ca3d554ad46c1f2f8ee82d0435350468e5a2347e6d3b890675297b8aadc257e25660e5036bbc9a322e1d5c672b27e67881dcaff109

  • SSDEEP

    6144:e6z4iI/pkgI0rxL01CuzxKsl6AIljkTkaa/SOregM0yxJghw3pQn0Ho8:taue01rxPwdSa/JegcJghw3y0I8

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2