Extracted

• • Target

    ff2d60ea92ddb15368c93963738a5d7e_JaffaCakes118

  • Size

    498KB

  • MD5

    ff2d60ea92ddb15368c93963738a5d7e

  • SHA1

    124475d978983a72674fcd4a21b10d63382cc221

  • SHA256

    1a99db372af0e284ee09aaeeb168335126c028c762ac6d337ead2f984678ded1

  • SHA512

    759d9fcc9bd87cb180f862ce0f795f7ae98298164426d038efdf8153a6976d5f8abd9abde048c777897bf26c5fc89b5828556ccf44949a9715a92284e3c2a954

  • SSDEEP

    12288:E4jX0gatIWv7Dts8JSQXVWv6tA7qDjOs12ZqO2xZi/IQaDl:EiX0gaO6JjFtA7Ascfxc/IQa5

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2