Extracted

• • Target

    JaffaCakes118_304a8e919a6830aeef90de93c347b9c2

  • Size

    1.6MB

  • MD5

    304a8e919a6830aeef90de93c347b9c2

  • SHA1

    8012766a46072a0bb27ebbbecbd0e0e3b307c460

  • SHA256

    eb063ab490ddf8d365c225cdf30f4a00471306ea361bd99526560b848ffdcfee

  • SHA512

    7f1a1549cb50119e15302f52aaa64e571cba4cedc75f760b38a2ae21d3fc53ca3b6b6f88df13803f84fbb45e175fed7d5f2ea04c77a86d8cf04bd0e267bdbf1f

  • SSDEEP

    24576:6i/XvMhyRIg0rU0UoMNj31snHEc+42hkxRbWQhn5Sc6/sQloVuDMAFj/l5ZZWrYu:6UfMu97QohuRbLn5Se/IzFN7ZBKrT

  Score

  10^/10

  cybergateis4.0credential_accessdiscoverypersistencespywarestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2