Extracted

• • Target

    debe64957d3c8bb73b2f8f6d0809ce2c_JaffaCakes118

  • Size

    1.2MB

  • MD5

    debe64957d3c8bb73b2f8f6d0809ce2c

  • SHA1

    f95c34e95d29dbd66c1cf8a1b6d55d7a96aa104e

  • SHA256

    2558eccb07cf148d31f2dabfb740f551e9107fac6287338b075f30e4530f4337

  • SHA512

    be2cdc15b15335d92edd7f85881602b744c694a047b33e70b2e739f281c4c3092fb1ae5ea053612dc5bd7975c6f5d922b6842d7b1128fcfe90e4b7d89f4b7a38

  • SSDEEP

    12288:YcZxYULthiYyS6MgHajxUM8GmXoxPl54pQ1QTvHz6yYEcUl6oKhG+xS6Y9Dg1DFW:7ZthioTxmTfzlovxHSU2othioTxE

  Score

  10^/10

  cybergatehondiscoverypersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2