Extracted

• • Target

    JaffaCakes118_86daa0df8dd18935c669053501fadd63

  • Size

    328KB

  • MD5

    86daa0df8dd18935c669053501fadd63

  • SHA1

    5ab286b5162cc6c370469d63630af2e53fd4954a

  • SHA256

    a940d3774ed7e75dffec1e70b0711392019a26cf63a02a52ee740047030a0118

  • SHA512

    913b0b5c60dbf83dacd4b998e936aabfdfd5fe9e75ddb1f3f079cfd51865dc33ac701ed8b539a8406641a672f051bdec45a5a37b40f7fdbb21c198de1fa50cbd

  • SSDEEP

    6144:YTQCHoNiMWOiuxgL19g0IrWX9SC+pQZ1Ai1TK+DKEWHMSyrRdT:IhbMWOiUgDgXW3+paqiJDKLMdd

  Score

  10^/10

  cybergategtrphildiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2