Extracted

• • Target

    b1ea4f6152c38855bec9673d558fab7b_JaffaCakes118

  • Size

    366KB

  • MD5

    b1ea4f6152c38855bec9673d558fab7b

  • SHA1

    19f9c28a04b255f2a075681df52ca93c2f5e8ba2

  • SHA256

    ee9676de09f2dae5f4f440ed58182c91e6335adc0c531a6e2dfe03513d9a79d3

  • SHA512

    682ac31a516c81ab443adc7a8379eff56080f1fff9315ba6bdb8aa926919ed332469a586d2eb9366f1ec36bd45145143c2af35d223113439424e4e3c630057c5

  • SSDEEP

    6144:lqHYCyOYE1MYADaRnzHMU0QrnuGvoovt/xNiU2Pu7BpLgJtRsLfIjHeXY:JvdEuYAORnzHMU9rnhv1t/ESBpLgJD0a

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2