Extracted

• • Target

    JaffaCakes118_3ddb4c6beca77ca96e29bb57ac0bcf4a

  • Size

    468KB

  • MD5

    3ddb4c6beca77ca96e29bb57ac0bcf4a

  • SHA1

    7352d84f7ec718562926cab62bd6afea072eb510

  • SHA256

    12f40c901eb26968f6528915a6198e5ae6c48afb52a841e8dae6372db08d6b49

  • SHA512

    9ec9e61ad2e98907d0b26876bbfe2429c442b68a930d0dbe5a432373fd5c35c060ab6bfa1f3bf2968566ddebda80bba8eeb7c4c93c886f5c77b21eca8fc2441e

  • SSDEEP

    12288:fgYD1u+uqly6paZBlkuKrIvRRoPznkwzqm8YWp:fd1/VGBlEUo7nHqTHp

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2