Extracted

• • Target

    JaffaCakes118_613a8703dbc434db75e270487afeb510

  • Size

    479KB

  • MD5

    613a8703dbc434db75e270487afeb510

  • SHA1

    5ff63c0723dd4df5a25f3c2179df70eff11daaf2

  • SHA256

    4d5b1a31b48c4289905e96486ab6de3de9a011de11dec4d554e3f32ed6bb5f21

  • SHA512

    94fb8efe652abbbe9a1fcf34e9045c63403234abbb0f53c65bbe83dca71f4b7afc214d9043758f10ee49b1cc362315a49117f3a1cc8370c4aba47ab5a6076036

  • SSDEEP

    12288:V3eVQkTrvj4xNzn0FzgLnutfaS9QZbwrqMUMbwnGF:V6QkTf4xNIFWnYfaFGRUMbMM

  Score

  10^/10

  cybergateúüüüüüüçáüüã çáüüüûüüãüæödiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2