Extracted

• • Target

    JaffaCakes118_199c5fe54962d93dc9ff8e1c4f83c784

  • Size

    352KB

  • MD5

    199c5fe54962d93dc9ff8e1c4f83c784

  • SHA1

    54a75601e0b5862a4626a4bba46e4e65cf394ca0

  • SHA256

    18508055f8f712845c8f5614c53cc765aaf3a4141ae4830e8c9e10171a6bbff3

  • SHA512

    dad7d7c7c62d6b3df7a7859fe74c18c5733dc8c29e7c19a3e8417a24e47f30da9be3ef51ae492d5194f1936d7bff68069c7484aed196fd25ba169a7f36b8ca45

  • SSDEEP

    6144:VBsArxVJ+MyA29kGVrGHINSK2bg+QEBJaOzLgu16g372RC8B5:EuB+G29kGVrGHINSKGDQgb5LrIC8B

  Score

  10^/10

  cybergateloriendiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2