Extracted

• • Target

    fac28ee0b65dd232dc01e4fbd0e933fb_JaffaCakes118

  • Size

    472KB

  • MD5

    fac28ee0b65dd232dc01e4fbd0e933fb

  • SHA1

    b4ff8ba40a2d7ba2fc8386344979a15036229a69

  • SHA256

    3291396907e6c2cf9ef8ea22c1bc41e3a0ef5499c43428e810ca8ad1a067f8f4

  • SHA512

    d44d97b77474b5767c0d99a20a00bfc0ca9ece1138063d8aeeae7aaf5737d86643782865e4fc950e72dfb136da0dd703037cdf4f40c37953e90ccb2992ef5205

  • SSDEEP

    12288:Fvri9lzcvLcWnNPhhW+KNB3p20xV4fPqo:FvrilgKTZ/AfT

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2