Extracted

• • Target

    JaffaCakes118_02a72d6004c6b600df5375897517b2f8

  • Size

    384KB

  • MD5

    02a72d6004c6b600df5375897517b2f8

  • SHA1

    d8f3159cb02c15fa60275b71decdcf32b8bbe3ea

  • SHA256

    ee1e1cd94dc975b02169c69c7751846f6c7f20a187c6cefde7a9fb19f012c264

  • SHA512

    52c1d2a412f13f9ad5b1679a61d9d60ecd6d1e34bb5eb9d45d905a0b1344ad617527e38bc7b8c0c077066c1b4db8a658b31950b421fe93d8e146cddfbfb77ac1

  • SSDEEP

    6144:bCR5vVul2NUi8PSTzPpAdzf+sUX6rfGf9RuAe6mI7Y8jqEpcRaatnvbFAyY:+Gk1yfbUKTS9oGtjjontCv

  Score

  10^/10

  cybergatenokiadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2