Extracted

• • Target

    b19292f38ef8be1c2605625d9e7e36e3_JaffaCakes118

  • Size

    902KB

  • MD5

    b19292f38ef8be1c2605625d9e7e36e3

  • SHA1

    a345aceda90f5e77d06900e43b510418b442ace0

  • SHA256

    9dd31a1e5f0f4af063c9a36ae444d81956b349d4d76e940cbe54eea5f98838cf

  • SHA512

    79aae4dc1c21a2dc168dccdf0b313718a8c4b268de5093a659566dbed9de67b93f0569240ec243188e5dbdefb2a4e46e601e37d6ee1c6dda40815b3093f87771

  • SSDEEP

    24576:XexifBRU3My8Dt91ky3bLLz073oEk7LgdDG:Xe0fBRJtfbLL473Y7L+D

  Score

  10^/10

  cybergate123123discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2