Extracted

• • Target

    JaffaCakes118_2bf1c0d481d61c789339c9df7cffa96c

  • Size

    1.0MB

  • MD5

    2bf1c0d481d61c789339c9df7cffa96c

  • SHA1

    f31ee2fae806eb8ed76362f8cd296fbd76b0de0a

  • SHA256

    a420b647a681dc83fc1fde9ebfdcb37c58a28e3d3a5ac4a77fad3d6fa3900e67

  • SHA512

    242ba16f9000e854889590dcd39f2d2cc5372f88a290f5f353b7c7b482d415cd318a1988fd1cb7109d507fa65b43cc6e14281e638084e00827a9a0054204b2c8

  • SSDEEP

    12288:nXCERT88gilpuqUtIz8M0/rgApCvIdfM+fTY+mASzR1jlmOcmQeBff2UJzGS+mVg:X6d4o8lMpkzJs2kSmCIuxK6/f

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2