Extracted

• • Target

    9763b17b9029e815061ad70e6e4b9ef2_JaffaCakes118

  • Size

    484KB

  • MD5

    9763b17b9029e815061ad70e6e4b9ef2

  • SHA1

    bff7dbcfc3401d41c918a57752dda0c364f67643

  • SHA256

    59c66ed7fb84ef0a8a2a963aa76cfee931b978bc34e47003ca22e07b334a8e06

  • SHA512

    31c0a6095222ae908c7c55dcd4b0044d80f13c1975d47723a5c92eb4cd10adc05f52228e7816a1731ae3846758ecb9d0c241ee72c414cc89403886d38d4879b6

  • SSDEEP

    12288:ZLoxxQhC+BK7FhCl5cf77yudTUzPMksHhI+YVPgjbz:84Wj6sX

  Score

  10^/10

  cybergate0discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2