Extracted

• • Target

    f60aaf331de41a10e3f5a8d11278b91e_JaffaCakes118

  • Size

    437KB

  • MD5

    f60aaf331de41a10e3f5a8d11278b91e

  • SHA1

    0e145b4dbc8b6c05866871145d841a393f2f95b3

  • SHA256

    ba36e0ea4101debadec55029e5d544ffea73c5ae5f656d4da19a744f79f0f051

  • SHA512

    3ca069992134d0723df175e2ee6235bf05880eb1762a7e027362c19e793cd28078eb79baead14d1f3bc71ece85c7029c50d7eabc4b6e8f4db051fdb31de27589

  • SSDEEP

    12288:/ZUkpb/JKDMz7sVgS8uqCagpwzcZ1l4/LjJXNuRzOGP://DTwB8uqCAcZz4/LjJXQzOG

  Score

  10^/10

  cybergatev6discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2