Extracted

• • Target

    JaffaCakes118_210d7c216c05d3bf41913c5407c32375

  • Size

    1.4MB

  • MD5

    210d7c216c05d3bf41913c5407c32375

  • SHA1

    9970b7ac9296cb416b80aa4ebcc2b721fb99ad56

  • SHA256

    6ed6a076359ed73942a099fca7d5bec00036551d2b0c40ba12ac58d1b7e0a924

  • SHA512

    cbd3df4e1281e4e416178a0c5c87d7cfb0d2d76860253f659fa31069b03c6ffacda387ba92f760439bdaf28a072542ab1a93f884ad5114d59c7d9dc82b939018

  • SSDEEP

    12288:N1UMXTVNpu/zuZRImSNnaVx+auMHE+/Vksxpodf5Bpm:NZiQ4Mk0Vk15Bp

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2