Extracted

• • Target

    de0ef2078e4e479844ea71714116be0b_JaffaCakes118

  • Size

    590KB

  • MD5

    de0ef2078e4e479844ea71714116be0b

  • SHA1

    2e816810286d2fa06e1d0cde1d071aa439d710b7

  • SHA256

    75c532143989a148c9e483dd2bc8ac62f473541acabf621abfefa5a8a75f8a43

  • SHA512

    b80aabecf843c638a01ac98dbff11f235dbdbe78d0596d04db7decb3719185e89f6c20ed40e06a2acdf7ceedb4e653677ae49c172c5f5969d65dec0d22fe3641

  • SSDEEP

    12288:lsFzT9M+5gFZJLl0JWuJ35kNIfJqyc52jQ43K5tbDbCXd0:ls59M+5ClW35PJq94j9R2

  Score

  10^/10

  cybergatefujitondiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2