Extracted

• • Target

    eea4a706d31468c5c8ff90b67c2d2f89_JaffaCakes118

  • Size

    336KB

  • MD5

    eea4a706d31468c5c8ff90b67c2d2f89

  • SHA1

    3bbaceaab1fac47f4257185cc656499901c9b0a2

  • SHA256

    f760728e0ca2e3a421dc62ff2913180514155820e05061b7bcec142999f5ed43

  • SHA512

    9809520d76902bf540473feb27a5054267f38d85b1be2a24b83221ace07dd85325cc7e3096b3b57215103271bce38ef95d97b4c27d5fb958546779797da7a8fb

  • SSDEEP

    6144:SC3VBxoVj1W16mKGkWYwRO6qmHrwpBOqYsqDyuA6ZufEXIm+1smBzXgN4e:5Bxs72YB6qmBsgyF6Zu8XImgsmBzXg9

  Score

  10^/10

  cybergatedefaultdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2