Extracted

• • Target

    b9da9574ae2988489170a9b0b480b4fc_JaffaCakes118

  • Size

    1.0MB

  • MD5

    b9da9574ae2988489170a9b0b480b4fc

  • SHA1

    59450de7a52f78049b2f876e4965f7121e0ea817

  • SHA256

    b7888ae582acc8abf50d0780caea828bbf2a43aef61a4b5eb02ef14a419496c5

  • SHA512

    a462536e1d3c3ee3cb19b61673f589778835771ac6d28e9ecbbfc24583cf5026f2b0fd7e033ac8b3efa0565f5db22c4ef84763c95d798516d8b21695e9443c24

  • SSDEEP

    24576:BRmJkcoQricOIQxiZY1iaeBmX4gwb51V/CnxX0G:uJZoQrbTFZY1iaeB4nwXJCnxb

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2