Extracted

• • Target

    JaffaCakes118_add48737c55c2c825fcd8ef35e22bb57

  • Size

    1.5MB

  • MD5

    add48737c55c2c825fcd8ef35e22bb57

  • SHA1

    e2c86c4a5378030ea338b450f94fbbfea132fbf5

  • SHA256

    32e79cd3da4810ed7f3a822bf30b97d4116bcbc34e325cbc45a85cef4cf5dddb

  • SHA512

    2404b5188ce42c81f7a57afbc47e3ead91241020caa81b4d70b48106c50a884815a08d3f46fd1c3baf3459c986bf44b8a089000b8d82ca09af45e49c0ed4d90a

  • SSDEEP

    24576:ql8QfAgftcJ+ux0xGGcHjYEwIafxobjev9Q+XfBnlbcg+eBPOq5+S7ZMjAaBMtnm:C8QfAgftcJ+ux0xGGcHjYEwIafxobje6

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1