Extracted

• • Target

    JaffaCakes118_a6ab624d25425de37b56d774c7f66047

  • Size

    317KB

  • MD5

    a6ab624d25425de37b56d774c7f66047

  • SHA1

    59da1234479fac1a949f9f3cf9d69dcf7f0ee81a

  • SHA256

    164daee7a057db81a59f98c35d2282530f626683758fc9cac4b7216dd3e34c13

  • SHA512

    ad2902cf7b6bdb9f21b3625f679360592746f890c24367ab7debd5b69346edcf6e6d9e2877155560a3c023bbf348f2336e832c00502f7d9ef35a8226c90baee8

  • SSDEEP

    6144:Bi/4v9akG9NGGGb5kZYQ7uYLr1jLF089CGS23DQltCTQ9OK21K+rnvhd/B:BW48kGmHb5mJ7jLBjp/AIUqTHtZvB

  Score

  10^/10

  cybergatevikingulotodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2