Extracted

• • Target

    ddfeb318e94cfdcb71a2ab90ccf41ce0_JaffaCakes118

  • Size

    646KB

  • MD5

    ddfeb318e94cfdcb71a2ab90ccf41ce0

  • SHA1

    e6ec6ef295bb5a32b8e4f5d670a118931f74b2ad

  • SHA256

    370ea743a9fa137b3e81228875af90080148be588e137b51e21f5b7d92dc0855

  • SHA512

    7783baef3f7da70e4b4d753c57c93dbbec07fe3afd4dff921e8abf8e37ba2c8b501bf795b4f10f05a9dd9e611fd5adb83b547535c3ff9b3f0da76fd275f0fab1

  • SSDEEP

    12288:3vKPkntsYVCgpVD9YLjIAWkScnUkC6TzTGveMP:fKPismHpVD9YL8ld6T/S

  Score

  10^/10

  cybergatemeowdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2