Extracted

• • Target

    JaffaCakes118_632317617664184139068b0d255f0787

  • Size

    365KB

  • MD5

    632317617664184139068b0d255f0787

  • SHA1

    011dfa9dfa8861cbd0a9277144ec84b71323b417

  • SHA256

    1a1a86ea8b59fd8b6ce26c6870f4a2430bbd506069755167facc4d1a42a2e75c

  • SHA512

    d2265d7a95db7f028eb7c9c2bb6b61484de01a50336867fa4e2cc0fc7bdf41269d9eee540e98e4c0f400f5b9af8d554e7069f848b4bb32cefa9f901d47312127

  • SSDEEP

    6144:scLlOMYukPxMo1o7p0+hlBvLPHWIMXdj8BgsVmwaGaptrzrN0eRg4StHg6VXH3U0:sKWJ96p5zBvjWIO5sVWtJ0eRg4StA4UL

  Score

  10^/10

  cybergatehackeddiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2