Extracted

• • Target

    JaffaCakes118_30e0e99d9b30c70ac4d9713f9f17f533

  • Size

    280KB

  • MD5

    30e0e99d9b30c70ac4d9713f9f17f533

  • SHA1

    777c8766d065cf52cf6ab730d7cded19ce4234f0

  • SHA256

    cb4707744c249a0db305bf5f3f99e6076aba8d5578de1e11fdbc3038c78090f4

  • SHA512

    04ed048218e694cd71aeed2cd1fee6982fac65d67d494c93186ed3fbead4264ce3cbd0f34792c0257269848a3e5d5e602e5f01ce0692a5b295e314d5a6cc3945

  • SSDEEP

    6144:psJwLdFy641YMEr3ndTx+kef8gDmkXRSq3fzvx1ijN8QluCJ9Z3a6u:psJSdFy64sDdQke5DF0qbXiZ8QluO9Zm

  Score

  10^/10

  cybergatetibiadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2