Extracted

• • Target

    JaffaCakes118_037e8fda86fe971d1a81cbe2ab73451e

  • Size

    802KB

  • MD5

    037e8fda86fe971d1a81cbe2ab73451e

  • SHA1

    75bc843da28ed01d575c576358f9277bbd7d917c

  • SHA256

    4d9afa20c96bd0a9ba1d809850990688f97d68d7e50557e7e0052a3635926d7b

  • SHA512

    a3456e44ed97383c5a46814e098d21e687c7b19d60b8c22dc5793802b0376d1aae55561c613be04e685d0d5edf0aa06706c8d0294ccd79e6d794beae52ad8c30

  • SSDEEP

    12288:CDbmxcDtOE2pRNacUF5Y1byJZSjDyrnltFu+0qAelh/dagney9J2+h8MD0Sz3mcj:T6Y5acF1OrrlcqA0JdJVuMD0SZNd

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2