Extracted

• • Target

    JaffaCakes118_09cb8ed618c666370aeffc818f0577a2

  • Size

    534KB

  • MD5

    09cb8ed618c666370aeffc818f0577a2

  • SHA1

    9e2b7d37fed00b7ae52e68ccda72eb20fd61e3ca

  • SHA256

    125f45e3c92747d504db48443246fcc018854d78b332146c222a33453b86b554

  • SHA512

    c8e25ededfc9633396c1fe50e4c95aad1eac983c7736dae6eca5dbf30829023403b0128efbbf22c841cf0e01ebfddf0b8881d1b8f0a876eb313b7db10158ffb4

  • SSDEEP

    12288:ZkKdVYlV829NzW1aoMse0OXzqFkCkSUKqESf0SLUkMj7votBX2J3s1m:ZxUlV829NS1v1B0zqaCkSUiY0kUkMXvt

  Score

  10^/10

  cybergatevictimediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2