Extracted

• • Target

    afb7b536a6ea9c059ae8b4d489b7682b_JaffaCakes118

  • Size

    664KB

  • MD5

    afb7b536a6ea9c059ae8b4d489b7682b

  • SHA1

    cd0ea98ca22caf010a64b08693cbca3cbd3a98bb

  • SHA256

    9f950b47666fe8ddcf87a5cef65a0466873a978848485f4d88971af0e7e119d3

  • SHA512

    eaace6f6fe4613834e10ebefdfa7c1ae35098bf9db9c47d0d0786d52d305e6c36273585b2ea0e90807321f2c335a3fa641de3ccdc4e3e8507c788628d142a7ba

  • SSDEEP

    12288:nzQ2qkBK+lgRuLVQv9A/fW4pF41jT9XB6r9p4nqk:U2qkBK+iuLVQv2W4pyt89Y

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2