Extracted

• • Target

    JaffaCakes118_06383ab90765ef101ffed3e9dffd67c0

  • Size

    360KB

  • MD5

    06383ab90765ef101ffed3e9dffd67c0

  • SHA1

    a5aa681340feea29013287fdcdabe5ff98e6490c

  • SHA256

    7bc6e795fdb1598c917205fcd0a3c2334619e0d33974723df48b7c3ef12e2601

  • SHA512

    229c4c1b6c9d1a16bf5c76d7c3738e4ce33866a691d47409482c6d86340e2d9d10fe32bedfc990b7a2b91933e6daab7c0257f358278f277dd7f7661f0356dd06

  • SSDEEP

    6144:s5c7G22OxGaXeGFdQTvE8g72iAsjuWU4OxRTfUX/0SGNv7a9ppRriFTQGC2bgH/F:EAhy/4UuX/SZa9TRriFUGC2bw/i4l

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2