Extracted

• • Target

    JaffaCakes118_d39f7b505a56182bb6afa0d74c62eac9

  • Size

    360KB

  • MD5

    d39f7b505a56182bb6afa0d74c62eac9

  • SHA1

    87a414aa539bd752b262504c34d95f2e79bf376c

  • SHA256

    bf981036b324f872fc4e4fcf8d26a88183d2d81b74f9ea3525b1ed914c2cf89a

  • SHA512

    38f1d40c818bede40e0af2857ded2acb152d0f581e66f71f3db38b033c82d5595418fc6cd9d21a2277a9223cf24d8a63eb86c108797673308219b7cce9b8fa81

  • SSDEEP

    6144:F7c9yv7DZc7QMmbMA3aeCtShnXdx3brhguJ+RmO5RzXk3HuAU0I5PA9XvvV2Wi:ZvpcvmbN3aeGmtxLr1vOryNJN/vUf

  Score

  10^/10

  cybergatesamuel ramirezdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2