Extracted

• • Target

    e2d97356e3463f5a5336565ac7e014b2_JaffaCakes118

  • Size

    463KB

  • MD5

    e2d97356e3463f5a5336565ac7e014b2

  • SHA1

    16b2193f1bcbf07855e3794dbe1e6e8254c14c93

  • SHA256

    12e1141af87ec7acfbe9f38540e98383de2a0fc2f8c5137a88fa0945f6eb1b08

  • SHA512

    b33c26fa0a36fdf4171907a6cef4811aac2fe217fddcbcda8eaf1e8e4c5465cd2436bd1097794d7be94a719d4be1d1d55a9899c9794e64764a9ace5a1d6f2a53

  • SSDEEP

    6144:jfpdYa4r0oLlfrXrfHqtQJBHUCwWQzu5nxkLv1BY42DorfJo1:jH4pRfDrSK5+CyPeorRo1

  Score

  10^/10

  cybergatemufflon12discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2