Extracted

• • Target

    36b1966bfa3bcb8b6365ed699e403686_JaffaCakes118

  • Size

    737KB

  • MD5

    36b1966bfa3bcb8b6365ed699e403686

  • SHA1

    67b78c617d3f539c2f3ad47f514446a6dcd93af1

  • SHA256

    23392a0828251227d45cccf3cd240ec4491d1f524e1d9771f5dd782746788912

  • SHA512

    680b949acb55e96fe3282f83242e9c4fa6406c7b15127826c11b2ad84553fd5f0279fd0f10688398fc9849a8833d1dcc0c2bfd42037b0869314d98f61261c30f

  • SSDEEP

    12288:vch3RYzSUn7SkNLwLbCevNBQ2dTqFXyhE2fCeLofPgZR+VSgvGDg1pyotVTW:vchBYmUOkNLAd7Q+TqIEfHVSoG+K

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2