Extracted

• • Target

    b1158419730ed87a7c5335edf03ceea0_JaffaCakes118

  • Size

    6.7MB

  • MD5

    b1158419730ed87a7c5335edf03ceea0

  • SHA1

    43501b2ca20c778b52704e471ee5b0e5ef89051b

  • SHA256

    b858a49ca55d8195c3bc6aa84082089a32dc82d565b6c3e4b408a9a56d454bf1

  • SHA512

    e5874e62d64653386c7ef9dcce246daccae50a2647a353f5c28a7879bccccc14baeab01f204bd3b0cebb4c6050d93a6fad9a686240f44f1e228009220fb925e5

  • SSDEEP

    6144:+eWqPBZKGF6Dlwyi4iIE8CuBVWQZNMrr63jaWAV5/f9oHtv:TPB8e6p+IEh6fMSOxV5/f0t

  Score

  10^/10

  cybergate2205discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2