Extracted

• • Target

    f9b38d407754ecd4ec8d73b2e3b3615d_JaffaCakes118

  • Size

    1.2MB

  • MD5

    f9b38d407754ecd4ec8d73b2e3b3615d

  • SHA1

    c56761a96ffb66b2831042edd14cda39435152a0

  • SHA256

    4d43682b3f75af18d7f930e6b572ab95fd57a83f6a877d20036852a0fb265562

  • SHA512

    bd65766380b6cda54d53222381eed0443b856439fc5e87e27932352c52639290dc8a5d96be3d017d6835d746d3c4eb6a488e2f9813d29227274f4f7d8cb9e5d9

  • SSDEEP

    24576:3ftS4B9wZ/c13cK2oxrSSKNmQUOvYeNkoLt1Da+dyzWNuk:vtfucxcMrSSKNrvvT51D7dyCsk

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2