Extracted

• • Target

    JaffaCakes118_84abdc4b73112e987756adb882d0a06a

  • Size

    287KB

  • MD5

    84abdc4b73112e987756adb882d0a06a

  • SHA1

    31c45c7533afc801db95b5920046261c6ebbd2d5

  • SHA256

    9ae60a225278bec26d9301f871c1cb5edd19d337154bfa67cd948229d2d3576c

  • SHA512

    6c5df0d5a9f89b0a26b572671f87a6195b2b4ecabe97efa9de3887b0dbdd3a9bce0ff4a8a1390995fa976d329cf0e0cc41f7634765d253292cb1b779c5dc4106

  • SSDEEP

    6144:7Dk3+8HI6OgRb16EjQY5XZQgruY4UxqCr3BjgQg3F:7DkO8Hrrp6RuZLd+Cr3mQgV

  Score

  10^/10

  cybergatevicdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2