Extracted

• • Target

    ae4e223d9b3587cba8c93e1bfc81974d_JaffaCakes118

  • Size

    552KB

  • MD5

    ae4e223d9b3587cba8c93e1bfc81974d

  • SHA1

    33c296e090fdf1d6b4ce9be265d7b9a36a726759

  • SHA256

    c787859c209bcd4b1e8517affc0f7e63160a0adc333134c2d3ea9d8c7bcd2d7c

  • SHA512

    5c851bccf6aaf81645a3f615840efaca53c2b2c645f093655612e9d082932f7b81156dc5cfb1e5622f0f04c3ce1895b759bec8afa2fc19ebca58f123d2d829b8

  • SSDEEP

    12288:15UAVtrJHT8Ae1/im2UHoeWbF42v9hYR8kP:0Alwrp2UHxeXVhnQ

  Score

  10^/10

  cybergatevalentinediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2