Extracted

• • Target

    JaffaCakes118_86dab01f0049d9753638c33e5b8537cd

  • Size

    378KB

  • MD5

    86dab01f0049d9753638c33e5b8537cd

  • SHA1

    6a1b5d7fb883b71b8cdef6b5a5cdddc93431d0e7

  • SHA256

    c74ba0b60ff2fdfc5e4195a073c956c55b05613e0ac95f4c31d1e25651b22cf7

  • SHA512

    a060299adb5f3c34e586b8dca3faef5ec017b60c658b08c5a0d4a104fceb61090282f24db1014f42cea954a0f29a433d3ecd9f3dcf29a923776575bf79d345ec

  • SSDEEP

    6144:mGVcVJ4w9ahiObyPQ/v/H0jr2HgraAjEWb05Wxz/ZYV0YNjXBsaVPLeJ8d2B+1gr:mGiahiObUQvUjr2HgrVEdWNhyNjxs2zu

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2