Extracted

• • Target

    bbdf418e6a83dd60feaff39c7d829b9f_JaffaCakes118

  • Size

    930KB

  • MD5

    bbdf418e6a83dd60feaff39c7d829b9f

  • SHA1

    cd5c3cccba93c7bd4faa54cbf645cc82629fd6cc

  • SHA256

    ddc6880962bcd744e67743b5807be8bddea4399a2dc992b9e80669a9bd1197c7

  • SHA512

    0fe4baaab88c59c619916521976b448443618d5c815f5ca819986afdcb9d5ff9bf549d7ab89061d2354866d6b700392390e307958274c84e09d46190a6ad2f4e

  • SSDEEP

    24576:WRmJkcoQricOIQxiZY1iaOpkxTmfKRrMdQX:zJZoQrbTFZY1iaO8Tmi5Mdo

  Score

  10^/10

  cybergatearesssdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2