Extracted

• • Target

    JaffaCakes118_15bf3602df21f1ce1cc859f5351502eb

  • Size

    532KB

  • MD5

    15bf3602df21f1ce1cc859f5351502eb

  • SHA1

    5fccf34fc9b720b9788572a416d2175b2f969931

  • SHA256

    6f8146b381a46d61b3927c0ba5f28a64e746fcd09c2dba5d8c405f4f2c8d35e8

  • SHA512

    88573392c9ba68b8c4db284dbcfac018a4a6cf757f693b709898e79f9cae24e67b66fb661ce82f76ec77f3966d33470bbb789ce4a399f1b0c7cfe90410ca48d5

  • SSDEEP

    12288:Sjg1Ylui9nOa/2uYORAQtJULdx6n+zFa4B/svcX0zxvTV5n2:Sk1+8RJfetTV5n2

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2