Extracted

• • Target

    JaffaCakes118_1855c70d334df8e27cbfe9df12848f80

  • Size

    324KB

  • MD5

    1855c70d334df8e27cbfe9df12848f80

  • SHA1

    ffa2d56a708d63ee3e61a477f364ce153070fc0d

  • SHA256

    45136f592879272a9ff4aa1dfefb30f542b3a733d66f7d50d01f5b4dac983169

  • SHA512

    d84058c4b0e67c5d80b089fc9e49016914be6c6f5d856539ea2d5d5ca2e8841ecf0dc361c87906ba1d97e847dc0ad3046a329eb6044bdf1a7bf76e1551043420

  • SSDEEP

    6144:rvu42NAsTT3EBsRfPkghZDpAOOH8q006woNUXUzF/pdoQIKNBYt28UX:SJn02Rk+5q16woN/Fxbp4I80

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2