Extracted

• • Target

    46b8955d2b9ff107fb9a37fb8ae9f735_JaffaCakes118

  • Size

    484KB

  • MD5

    46b8955d2b9ff107fb9a37fb8ae9f735

  • SHA1

    d9c65d40299577b7b5774b18657680e59f7cc7bf

  • SHA256

    13a6ae75ba248a789b4b4999e02b81d7e7fe49ec770de181842a87ba23947b61

  • SHA512

    5e26ee8301f54253d53bd26faa3f82150a603c082ee077c20604dea0241817eb6ba2069b574c76567a31bb3e6a17dc732e1af371b780616623656623f7c1e039

  • SSDEEP

    12288:N9osVSdmUiitwkaRXrcmHaHpmCH3y8bP5lepyKYELiPeOIfhErtpJm4Oy:/yi2KtyHViGpYfem4O

  Score

  10^/10

  cybergates999apersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2