Extracted

• • Target

    d9e22396088e348a57752284ae950d4a_JaffaCakes118

  • Size

    984KB

  • MD5

    d9e22396088e348a57752284ae950d4a

  • SHA1

    7cf767650a8ee763af1f77dd4f78bc06a605a901

  • SHA256

    43881859bdb26d8de02d4d8710ee94934c1a3242021f7303d15f2333e85cf446

  • SHA512

    29538fae7833732625966d77d845e38010a8799ebb37be6a44f5b0e3d438b0a75f905a46ae4c2679ad85ea3a119c92e78d1c185aa73871265b82ce47aadefac0

  • SSDEEP

    12288:Ty4HdZuJ6X6So7YNQw1F85ZwKd89BcF8vjBplYXNpbycdc9vMFmsh0gVLeQav8If:TPpOwQoyEvOKdpEcVIm7g0QrjI5l7v

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2