Extracted

• • Target

    JaffaCakes118_f59b380d2f9090f66bff3c131613ba24

  • Size

    340KB

  • MD5

    f59b380d2f9090f66bff3c131613ba24

  • SHA1

    ede3a0c30af12b73b5d0456adfe68c691cfa4a9b

  • SHA256

    15a4dfd5b4e265a93f8fc58620d0523faf0ff3a965fb96f9f36c8baeb84a7d3f

  • SHA512

    07ee698b19871a316172880133e398c784267b1b5e5345a3d02603103f2a9ccf3f8b1bd704f5d57d888fb15dc47f804d4beb9a8df345f4a604320e8714e77d87

  • SSDEEP

    6144:WiNva1k2mZbh0cb6T2HNeZFZUIllP5Xsy9gs:WiZa19mkcS2tKpb5l93

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2