Extracted

• • Target

    a92d6883b0556f75d569fb76eac561d1_JaffaCakes118

  • Size

    550KB

  • MD5

    a92d6883b0556f75d569fb76eac561d1

  • SHA1

    b94fbb563e69aa5043d1273487e2d2e7e8363930

  • SHA256

    cef0097b8deb1113156c08bcc889706f7bfc1f2e00bd12360cb50e68b475c06a

  • SHA512

    7b697fd939eb7114063e2d91c1b095678469107d3b5c94c755d56548f93e5625c64e4fcd3b70e2d991a2796c71c531303b64665f3f1b313fd4c9aaa367f9eff1

  • SSDEEP

    12288:P6gFNCZs6a3DQkSIK1KnvQKuFjicdtX2Z10o1cLzKWN8kFvD5nuI:P6gz8sykZVndcucL2PnWD5nuI

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2