Extracted

• • Target

    JaffaCakes118_14c5e8c66914e9dfcf318a75a95924f7

  • Size

    448KB

  • MD5

    14c5e8c66914e9dfcf318a75a95924f7

  • SHA1

    1458d78133025ce914168e0bc93dfdedb78aac35

  • SHA256

    c209623657913116ac75fc40e420a71c7320b74ae205d4b9f231a74399f668d8

  • SHA512

    1c7fa9cfe2d573294fc215e1e03c4849129972843e40cd8acb83f1cdaadc887c883b20b1a33cc9ad032dce49f405d1b020c7ed88af7a4bdcd5a0c5916056fc19

  • SSDEEP

    12288:+7wd1o5zI6ZJqZo4haL7yO6EZWE8vIfZ:+7w/WzI6CZDY6EgE8vIfZ

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2