Extracted

• • Target

    JaffaCakes118_4d6b0761d92e20d6a2d1335b78a08411

  • Size

    1.3MB

  • MD5

    4d6b0761d92e20d6a2d1335b78a08411

  • SHA1

    dd1e17fd9f43b7f112e3b849552bb71bf711ccb1

  • SHA256

    7562e99904da9e824f6a7790f6565f3f79b02e79538e057be0844bf80ce128b5

  • SHA512

    8b50b1fdd49dfcd666b7feb083c22ebe787020bf7b3dc4ecb48756defe69b2a4687a38637302b65d25c1173b83a152f54bbeae29e6f21e6140c39c3b8817edfc

  • SSDEEP

    24576:a2iAPWleut2o3wpQs14XmlrwJ+l4vG1mmejfDk52Xjf:yX3wwXmlrwJ+l4vG1mmejfg52Xjf

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2