Extracted

• • Target

    fb1345ba60201e542112219d898059b8_JaffaCakes118

  • Size

    370KB

  • MD5

    fb1345ba60201e542112219d898059b8

  • SHA1

    184d9a4b41bb1debce02d542ddb46ea4a4f85541

  • SHA256

    344f85571f9958df24334e33c8e2a69164884b7121d88edc3fd347d4409be0fd

  • SHA512

    f45fb4543c7619b77e13e7dba23a256dc1b3b68fe8988cec3f9dd28e201ed26f6a018a8b7c3e16527dc4e88fa636a85fda59b19d9f3768b8020020ab4807b873

  • SSDEEP

    6144:Lodva5Yn+GCauArUGe9mZfplnIhpcjDrLMfeyLT5V6mIl:IaLAv0mRrnIPKDfMfeyLT1Il

  Score

  10^/10

  cybergatecrackerzinhodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2