Extracted

• • Target

    JaffaCakes118_15bfc827bd35604371068fe122118367

  • Size

    351KB

  • MD5

    15bfc827bd35604371068fe122118367

  • SHA1

    bfd35211f70300596101b35da731e1538125a8a7

  • SHA256

    1033ef17defd255b03a87db351db5d90935da2a06604af72e7ab3f3e0a3a211c

  • SHA512

    b56fe0e07fc8f99474736081900c0af3b274237e1c90df634a45a7ca1d678c918e38afde799b42977819875a70ebd4769eb25491d92e5f3f703a287854891fb9

  • SSDEEP

    6144:NNLnZa4KWd7CbOqKQ4OefAzBzpS4XnlN+Y/OiP0KuUbw2ubrcLGdqBFK5:NNLnZh9C69Q4XAz1d3N/OiP0HUbw33cm

  Score

  10^/10

  cybergatesvzdefense_evasiondiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • UAC bypass

    defense_evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2