Extracted

• • Target

    0d7a806f76bab6cdbd2e08a380a6c2f9_JaffaCakes118

  • Size

    455KB

  • MD5

    0d7a806f76bab6cdbd2e08a380a6c2f9

  • SHA1

    dd758fe4f119f5876212a600e675dfaff2f449fb

  • SHA256

    676a53fe096a00d736c8f192eed01f61d48e8cc381a033de7be986642c15685f

  • SHA512

    575da68b53d2d753e8b566669e74b1abd2d9c20a7d436cf8940074d7718346d6368e63d8dc66e80afa41a2618a69a80a025e96f746b87b47b1d607b093b400a8

  • SSDEEP

    12288:4isdI+OsvjLr6NWDXXjvRQMfBYcSZ31/hsGFUxevbw5:s5jvf5Y/6G

  Score

  10^/10

  cybergatethorentpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2