Extracted

• • Target

    JaffaCakes118_120645bf143cdea5ac62c48ceabc6d27

  • Size

    633KB

  • MD5

    120645bf143cdea5ac62c48ceabc6d27

  • SHA1

    44957395a5d437aa4728bfdafee323d79089b096

  • SHA256

    dda0feacaa9a600f91f2a445dac533329e9ed1f78586d1bdc0c0b750f0d852ee

  • SHA512

    2b659da983465a54ab46504102b945d97419ad3731542490a810c1fa2c0e6995f1633ac28989eca6cbce0d9409ace2b19612d3a784161e2f315274d387f01c01

  • SSDEEP

    12288:pYUothiYySAWQAYMuBkKoKNFaBNWViDIkuTT1cmB2wQPaTHJrPYllXaTe339ZobW:Mthi3fJkzWFaBNWPbcmBbpucGPb

  Score

  10^/10

  cybergatevicsdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2