Extracted

• • Target

    c1bf6d15ce7e4091f9884a08467a2363_JaffaCakes118

  • Size

    475KB

  • MD5

    c1bf6d15ce7e4091f9884a08467a2363

  • SHA1

    2d9d5db8aa6fc542244ef6b01b8e5e4b2c9865eb

  • SHA256

    47823eff80578f9115005bedd2919401deefdbc6de38c324478c4646e2896357

  • SHA512

    74df44c921a837ccf6e7c936bf40882d0205a38cad73ba0b359ab6b647554737fce036b1490d16621b0b9eeca0e5591f3ff71388cea09f4780406416687ea373

  • SSDEEP

    12288:KW3zdHmq5cQWO8A5CHgfoU75jsryGqHZpvAsJ9mu:KW3zdXcpO8A5CHMoUmO7pvzJv

  Score

  10^/10

  cybergateaush0kdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2