Extracted

• • Target

    JaffaCakes118_048e2018c3c5507e4170479d40925fd5

  • Size

    740KB

  • MD5

    048e2018c3c5507e4170479d40925fd5

  • SHA1

    2389d63a82850be70ffe1d4168eeb187838e7778

  • SHA256

    823a7208a95b4b921dc16b11244f287619c6305193f5637e7e631b4f4374f0fc

  • SHA512

    718bf41471d1a677691254059dd849c90f705d0e64a5b27fc9dcbddaa9a6c030873a1c6476ef061a1a671caccca8b2e1e1362cb7a49c6f7206077d85c5ad9ec7

  • SSDEEP

    12288:j+inJTrnft+DybVE4KfHMdU/QKZV7/3Ow8hwHcC05XHJN9r7umlq51mmFCSm85Sx:pdrjHspop3pHJfr7bMWd

  Score

  10^/10

  cybergateremote1discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2