Extracted

• • Target

    JaffaCakes118_d951b529e2e025415bbd2c4f8d46598f

  • Size

    660KB

  • MD5

    d951b529e2e025415bbd2c4f8d46598f

  • SHA1

    5c7e5c1b4bad605e3fe332ae56d999c07c24c37d

  • SHA256

    4fd0b850ca44b0e5c89786b556c7c9a5384911f5d2d0190349bd5a6786b12fd8

  • SHA512

    7cde0cc5927d679487a6cc4d5b5f8686dc1e1dc097000353433ad49b4f309c2fb2ff28b9fb20a7b8049fcff7036ee36e7448e8e4a1ef0f6b9e9f821dadb81e08

  • SSDEEP

    12288:T4an65KEbidg1EwlQ+r73WpYiCXtBcMdBOSddhQcGgDJeVJI4FqntC/IuokYR:U/RbfKwlV73WaiuzDXR

  Score

  10^/10

  cybergatedarkeicdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2