Extracted

• • Target

    df3a03a1b7bd7ab992d3d5eda8472ef5_JaffaCakes118

  • Size

    276KB

  • MD5

    df3a03a1b7bd7ab992d3d5eda8472ef5

  • SHA1

    3b1d3045ae3f169ebdea39754df5719b4f2f27b0

  • SHA256

    73dff9d55d299dbcb69f8c5a6dee362e401f94141f625e8a26ad9ece3836af2f

  • SHA512

    179110742e8250a0678d75bd035ccf0e38da880c5b5f2ba73db5a121b0ad5018226222e6888a2f8b546146141f936240fe4376cc6a5a8e24119a8bfeb815ed3a

  • SSDEEP

    6144:yk4qm4HSAz0f4jg4yV7+Zo04NaEkxTOIg2FQUNKbfi:N9/SK0f4j44o0AkxT3QUNgf

  Score

  10^/10

  cybergatedraco victimediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2