Extracted

• • Target

    JaffaCakes118_5db425f7a3bf0b6b323d392972490b97

  • Size

    1.7MB

  • MD5

    5db425f7a3bf0b6b323d392972490b97

  • SHA1

    ac313dc66cf0ea4861a595733c7ec39d6e12ad4a

  • SHA256

    ec3003a33cb99ab94a3756406246a183232e7eb5d24d63301fb2072b28f474aa

  • SHA512

    1adcf066896cfb0ce8bc351ea17dc685424c190e77e0536cf8f08c6f3503dbffe4d18dd98b49db42e8454811645838297a16e2214c6fd189cd7edd8f650d63e4

  • SSDEEP

    24576:FK00PfCjS+4b83tb3Kdpo6WpKbJgtXFj9me1+tHJDXHle7nLWzSTCS+wMn:A1fN6yi6W2Jgt1h4tJFeymTCO+

  Score

  10^/10

  cybergatebota fogodiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2