Extracted

• • Target

    JaffaCakes118_832d8026a5ce3a1f733b1b98134b6ba6

  • Size

    559KB

  • MD5

    832d8026a5ce3a1f733b1b98134b6ba6

  • SHA1

    9463d547b8db60c8d78f30346c9db500fe60a140

  • SHA256

    961224eca0d96410f820ea5af32a2b8b456ddb4a705d279012f8e36b78827be9

  • SHA512

    4f331a432ae1c4696d56ce99626e2241fd5db10509323649eee927d66180c4422a7ce6c13d84075714e9c5b8baa15ccebf32fd0ae803ac03ada24e8b3610e36a

  • SSDEEP

    12288:N+bwK4O0ucxOJGHfVnGLyWSKaAS79MEqfGP:s0VuTYfEyiSZgfGP

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2