Extracted

• • Target

    e7767f12115aa6fd795a783f4a957ca7_JaffaCakes118

  • Size

    827KB

  • MD5

    e7767f12115aa6fd795a783f4a957ca7

  • SHA1

    589b02ed2c36e058aae9f4d363c53d751730f58e

  • SHA256

    4e5727770fd1b84cd2c0d57f25b4e4a9afc28cf11f6a0e4852e32f3d08030e4b

  • SHA512

    24746a33721c71fc1af9f2476e55d04dc897700d6b668daeeba82bea21afc020710bec24bdb071d1bcc6528e15d4d516f34ed17d6edb3fd4cfe5a4f3f444dba8

  • SSDEEP

    24576:fXxf6BKbsMCg6EjivEQLt4qzYwz6pRpK6W:fXh6ZG2hY5pRp

  Score

  10^/10

  cybergateêîøí çáèñæóíódiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2