Extracted

• • Target

    JaffaCakes118_802b3808e49974c07c97f0037ac01697

  • Size

    3.2MB

  • MD5

    802b3808e49974c07c97f0037ac01697

  • SHA1

    2a000dccc3515bcd4bf7e81345816829e6ca5f0b

  • SHA256

    85367531126d49ef230079679b938cc89c54fe39d9183dfe3bb59a5f61d153a2

  • SHA512

    5fcc7e832491208278ab333bc1825378bcefa653184da1e44799f587aeeddbf82461d6f5ef0ee14d72b192608291a736ff9a552f371f4b7494ad3cddbc9711ce

  • SSDEEP

    6144:Epm5sFENKy2EgbDLaRDEHZqIK/8JVRkt+hinQIhCplq:EA4EIjTnLa+Hk8fRktgyQIcpl

  Score

  10^/10

  cybergate1601discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2