Extracted

• • Target

    f7182600d7938cf20e48ac2bc5ae69a3_JaffaCakes118

  • Size

    501KB

  • MD5

    f7182600d7938cf20e48ac2bc5ae69a3

  • SHA1

    6ade6323109d90daeb5076f9b00354258ae1b687

  • SHA256

    6af92343d79a4a5d8aa45f58c80001ac5a206f5b17a35587fb084e9cbb489f4c

  • SHA512

    c6900e01e78ddb4a6d366b319ad00deea61e8ec7b94bb68f64e08218ebf6699eed89fda7dfc0a2013fc003d74590f185957836c86a94e997487dc96f07071b6a

  • SSDEEP

    6144:4hAv2KgMgPkXZDSBqfAewAcA9AIdszRsMAPf5uAyvBmct7dtvEsOJCjHewS7cwWP:6Av7NXLwAr9V2FsPf1yP70sUcy7RWYI

  Score

  10^/10

  cybergateminusasdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2