Extracted

• • Target

    JaffaCakes118_2639af67c040f4aab1b0bd0382a08f69

  • Size

    1.2MB

  • MD5

    2639af67c040f4aab1b0bd0382a08f69

  • SHA1

    d4c933f713cdc93e4f13cf026d8cf347f3720c16

  • SHA256

    e096cfca85266ef591278324664645e6b2cc3ec3d8c39d34a44948b5374fefe2

  • SHA512

    d1bd1dff309b19cf2fe767fb9f8830588128837f89ada4f05de86e48a86f1c5fafff967668be0a03cf78dd9d266bd34bcca5fccdb924799abe4b3119edfd0577

  • SSDEEP

    12288:OnJxyxpdB1c2eYAWUfOiD0xXTSCGAdh/p6dfx8w4HbW/tghl06mdqOZ/u75/xBmm:OJU/JrAWUExDNFHfrwchseW5LpcS

  Score

  10^/10

  cybergategames_piratediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2