Extracted

• • Target

    JaffaCakes118_8521e0d53f2df7d6cd826d8394972a24

  • Size

    337KB

  • MD5

    8521e0d53f2df7d6cd826d8394972a24

  • SHA1

    e596b133ba50b0bc1b0dc032e208b039736c804c

  • SHA256

    9b16652c19954722b0236c4cc2e3ca9a2312a328b85fd377d3a124d3ced202d0

  • SHA512

    9afdd30fef7e39c61cb5ce2d18bd603dc6f0c6724cf0161ae00a6e16df8c4fde239b66c666c150f1e8a8c79aa9d3f6a7a1d81805a7e7367e5dd44d8fea040b53

  • SSDEEP

    6144:KjlaVvVXSJKCXF/Ro1OcpBa6MeKMtmMulbLLHEtuCR+SBBvk:Kj2vVCJZXBRoQP6MeIlbfEtF+0BM

  Score

  10^/10

  cybergatesin escaneardiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2