Extracted

• • Target

    JaffaCakes118_6d5d878ff7c90bf233c875c171b26b27

  • Size

    972KB

  • MD5

    6d5d878ff7c90bf233c875c171b26b27

  • SHA1

    6e60198b2b5116b5a3c47fda1c36731714c3ac6f

  • SHA256

    380e855247fd8d3e995a6fcafef3e28c4ee88c6fdd32268c4e7c60361afe0952

  • SHA512

    8aa5d245f76e9a1dba9a369b5bba1f372c4c84ef94ace69bf3720e0645f538ca57ae1883ee7aa86fa1695737290cf5fe182a8936b0999ab0bd40fc857f6928a9

  • SSDEEP

    12288:da2ghIns7Dsw1z60yeyKT3Kr/w3jcs5ET4D2WPuuEPBZMZ95fHr6ojUqZ5OLQVPB:dy6szWrIjwUD5y5WLwMRttg7EOOuY

  Score

  10^/10

  cybergatewessel234discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2