Extracted

• • Target

    648cb8c726d6ac5047e24f4c3aad44c2_JaffaCakes118

  • Size

    356KB

  • MD5

    648cb8c726d6ac5047e24f4c3aad44c2

  • SHA1

    7bb03b62a9855254b5ba8e77d237af0e174735e5

  • SHA256

    687e17197517592369bb2783d4dc90f1a9177be7adc7fc901b68c1e07130a998

  • SHA512

    67f07eccf2bf7c3e6f7c26f52643f7f6183ec922ce10f96acf5d4cb068a8b3684ad29900ab5a3971e6d8afb07e72ed6a37adf54fa1b78bac9f67294582b86ba9

  • SSDEEP

    6144:pOU8+8HEGVr8Kd/sHsXlIeN7t01hMY17QTxLxpZKEouNpGq:R8+8XDFOsSU7t0tlQ1Lxrou6

  Score

  10^/10

  cybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2