Extracted

• • Target

    ee724c5ab6bcee2c8f73c421fe5ea16d_JaffaCakes118

  • Size

    327KB

  • MD5

    ee724c5ab6bcee2c8f73c421fe5ea16d

  • SHA1

    38e2744ee7b80d917c2f76996c96c1c3531055e7

  • SHA256

    7a342c2ea3c587f8f6a9d7aa1c85001d068388d00c58d692494b644a9121bdf9

  • SHA512

    fa6a183445ea6b920ec05970a1511216e1b140a0a54559a241ccdb8a78270429f3829701bbd99c9f5034a3c61249a0b4cb41e1f10341213837e66ec2ddd675d7

  • SSDEEP

    6144:mf6ekg/ERJiBrdLVHNYru2dLeGkQyNsOSIzd8WpLeqtlml6l:FRt/iZdBKrPgGIqOlZ8KT

  Score

  10^/10

  cybergateaquidiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2