Extracted

• • Target

    JaffaCakes118_691aedb678b531eb0534369756db87b4

  • Size

    353KB

  • MD5

    691aedb678b531eb0534369756db87b4

  • SHA1

    a8bc80e9e5ffc13e16cbb0f6c2016c3d0bafd016

  • SHA256

    e57cfab6315cfd3f8ce04ba9ffd2a0777f6a3af0625ee06112ad734a57c747bd

  • SHA512

    128716d34cac46e505176d4abb5fcccb375c3556105bc10fd54d40013bdc3d131ebdd06558ba48cd50fbe51f54ed7e894c114c2f8dc620d70ba87b7eed43cb2e

  • SSDEEP

    6144:emcD66Ry5JGmrpQsK3RD2u270jupCJsCxCBIGEKbS5:bcD66xZ2zkPaCxpgw

  Score

  10^/10

  cybergatekurbandiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2