Extracted

• • Target

    ac710fdd7b45de73889d3fcccb0c7e7e_JaffaCakes118

  • Size

    340KB

  • MD5

    ac710fdd7b45de73889d3fcccb0c7e7e

  • SHA1

    bdff51012e7f286c7e4e2f123192df1c468f6263

  • SHA256

    c504ffa39332b34a325a9b1409ac5bdb86595d2b8c3d8248b141b5987455827b

  • SHA512

    4d4d6f7530b8291e921d9dcc92be9c75b6dac7cc77b392e9ffaf62d8e165c8edcc0e30363d643dd5d5c1597dcc26dd0fa094dc58cf22b9843392043e58c72045

  • SSDEEP

    6144:/Yv0aGYXpO8+MPl3EpElF5289/n/LkWh6L4CNhEywaFmwSoX6Uptu1QJdco0gr:gRGYXh+IF9/n/Lk4O4CBwaAwr6hkdcBw

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2