Extracted

• • Target

    JaffaCakes118_647367f2bceae00cc0a2233134c009f0

  • Size

    991KB

  • MD5

    647367f2bceae00cc0a2233134c009f0

  • SHA1

    b5bc30d005cdc6f6435fff9afb93a855e1205ca7

  • SHA256

    152e91dcc743f5f8eac55382d215ef544d3bf0a5ae185c7d45ccc0b898f204bc

  • SHA512

    a0df2cd517fb20762d7d0983e69e644b256326fa47bf80db9f615d11ceed8c96fe8a442de393846297468d8ae782ada0d88dfd396351607e996e06282058c654

  • SSDEEP

    24576:cGkKmZOklwemI5pUdcJ4xbCr7kxF7cTe83:clOddWdvkxFq3

  Score

  10^/10

  cybergatevítimadiscoveryevasionpersistencestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2