Extracted

• • Target

    1560265a8287c8853f8dde51521cad0d_JaffaCakes118

  • Size

    606KB

  • MD5

    1560265a8287c8853f8dde51521cad0d

  • SHA1

    5318da10255a8af634362e0db44f25535d9b95af

  • SHA256

    ed7ad0efb62555976b6349909c3967612a4d76e9a65f77a2d6685568ab243d86

  • SHA512

    1d314ef0aa535fe762f6ab393fb7a06e62eacd1416ddb9a4baffe826b815a1aa8588f567fa64a45d34e8d448fe7ceaddf21624659631026c5fa7f00586c3f7c8

  • SSDEEP

    12288:ChOi0Fw/xTGqx1DZ6Um6kgkuuTNzc//3OJBO+w8kO:AOi0Fw/oqfwUmPgk7c3+JB7kO

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2