Extracted

• • Target

    3a2e879afde3064add0769df1f34c04b_JaffaCakes118

  • Size

    497KB

  • MD5

    3a2e879afde3064add0769df1f34c04b

  • SHA1

    1c43b922786be576ea5923c8f5a58b866e73a70a

  • SHA256

    e76752214cb7545481b53565666025da357233e8d94dea3b40451f618f6a0fcb

  • SHA512

    66fe464466b3f1da8a9af99a55b7f78241b41037d7315b04ed57f2e0502c5bdb1846b916578d1e58bb241e0501c8f1c9742e92e9b757583dff5d504cfe377ade

  • SSDEEP

    12288:LHeVQkTrvj4JcJabtrfFADM6eKUyww4IaziH:LKQkTf4+JaNfFADDdUywwiQ

  Score

  10^/10

  cybergatecyberpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2