Extracted

• • Target

    ff414f1309d5d515142db2007e5d46c9_JaffaCakes118

  • Size

    816KB

  • MD5

    ff414f1309d5d515142db2007e5d46c9

  • SHA1

    efad0212cb6a13af7f91da3377a15aff4f5fccf3

  • SHA256

    683066a289047e0ac2dc1045625ca7eca3a9182593faedad0e0b9380a56bd95f

  • SHA512

    7d789a8791858e19220cd830c2be128086a7d7e7f7e1e6d0f57c7e6c6f0b06de95552cebfaa6fa8beef969724fe16acb4d478b8aaf833e3a78dd5e842ac3c30b

  • SSDEEP

    12288:fOjvNofe8KpiwQhNx0miyC27IN7JIiuWaFkb0U2pUWh2uXolEeaVyTZp7pdiaMEO:Aoe8Kec0u0UfWa

  Score

  10^/10

  cybergatecyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2