Extracted

• • Target

    JaffaCakes118_822c747b4689484c3a4f294ef594190b

  • Size

    398KB

  • MD5

    822c747b4689484c3a4f294ef594190b

  • SHA1

    e7a46f35c5090b20c3e280a5b85e543b623cca58

  • SHA256

    55113d1170bbdb22998e6a872044b61e662a8e9b239d6a9aaeca7ce5b22190ba

  • SHA512

    22cb4b9c01c1cf6ad9abb7641abec535171b614b1d711cc1553f3124f1b092190571fb452d6a5903fa1b53ae1140fb77769fd09691818ef39cc755de23663d86

  • SSDEEP

    12288:7DHIQJhfWPADqWGDSBJ0z8Q0HZG3BCKAELizDX:ndbWxWGDSQBSZQBeFnX

  Score

  10^/10

  cybergatevictimdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2