Extracted

• • Target

    JaffaCakes118_2de9dcd9d80f91c6fcf6bdf90c4d4bf5

  • Size

    395KB

  • MD5

    2de9dcd9d80f91c6fcf6bdf90c4d4bf5

  • SHA1

    54d3ea0f7fa184a5ad47973a608809c37fc385f9

  • SHA256

    a13e537dbd0b4c089cebd9f7744181083f79a913ef70e61c142ea411b02f9ff4

  • SHA512

    fe38b4242bf163bfbb57e44caff241390b778bff716a7bd39aefede9d3b6184523802521714784820a41862df6b819e25f5275b0bfb06844d9c3873b25df3cf7

  • SSDEEP

    12288:EJl6tGGUBvBkZe75wc5jI9/Xet5kdJM6v:86tu8ZIOrUkLv

  Score

  10^/10

  cybergatezombiediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2