Extracted

• • Target

    JaffaCakes118_338382e28510f81f83ad93fdcf10497a

  • Size

    324KB

  • MD5

    338382e28510f81f83ad93fdcf10497a

  • SHA1

    621ddff072d7141fb959ba7d462030390d947fad

  • SHA256

    68734a54596a20a94ddf13d0de2ef98ebb5a44b653b0ab9b9718f29979eaa1b2

  • SHA512

    d6f5b397276625680d2e4cff56c5ffbf479cafb3f559ca09a5064c0c8cef99f61bd86e1a784caf0f542075545d901bf32651ab14d127528de27cb286ea948d73

  • SSDEEP

    6144:Rvp/o/MjFKoQicFVeNZSY5oZ7Z0nhWGPYA6J962SiFH5Rwy3Kw9:bA/MjFNQdeV5lhWL/FHnwpw9

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2