Extracted

• • Target

    JaffaCakes118_78f6c1b49e95ed4d2a4c21af41aaf6ca

  • Size

    384KB

  • MD5

    78f6c1b49e95ed4d2a4c21af41aaf6ca

  • SHA1

    532c74407ab699d5b838590254d386d2287526c8

  • SHA256

    36bd6a1fff57ba9da35f565479f615accc534d0aab500817e9c153c127cb3b55

  • SHA512

    479b83a2c1075ffa598c1d906fcfe414cdc4a33947c2acdb02cfc4c7d516d4378b5ed76d1f6d6f4ca8971732283e422c0f6eb9502128a72513e632918ab89cc2

  • SSDEEP

    6144:cN2rUm3PojWv++JYJpO9c4KHEdMyO/x6qaSj8loKcPK1dKN1THx/gm8SP8dAk5:cdjw++6lj0O56q4tK39N8S3k5

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2