Extracted

• • Target

    f178090ff101be9a288c18b109c1caff_JaffaCakes118

  • Size

    373KB

  • MD5

    f178090ff101be9a288c18b109c1caff

  • SHA1

    78780fc9af10edef8fef71054712bf0612ed92f9

  • SHA256

    e9a3149f654848ba4da1e331c82aa142b9036b897224462ef5db1384a6b18515

  • SHA512

    3d392fccd75e7af6c80198d9baf9c5d76311bfd60db41d311b30ad0876417ef8289422efa8c6413ed78922a4ced6a35e22bfc4fbc7efc2a58a6c70a2986d782e

  • SSDEEP

    6144:kmcyq0wYBtgiMRL2Jsld2O8nd4kdTE8pzkDqorGgH+wgwcSGrFfhPZYem:hpKYBtx5OrkvdT/FNorGg8wArFRZm

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2