Extracted

• • Target

    JaffaCakes118_0331ce65fbb378613a7bca41ab58bfde

  • Size

    812KB

  • MD5

    0331ce65fbb378613a7bca41ab58bfde

  • SHA1

    e18ece0a14af128e718368eb84d0e4906a76c0b3

  • SHA256

    698b4155ed65b515472c6802db502d7c5b23bcb2f50b820f4660415c9bf27152

  • SHA512

    c06f74e61d8ed95dd0bc4e18bbe22d09278965c8efe76a4425a2824844b13c66e49692325d2f696d575e170e15b0081cabc4d8080a9166eb1c95fc54aa14e07f

  • SSDEEP

    12288:3W+vNwyubdHQ9MYQ0mhW2EwylPnkKI+h9/kQTkTA0BvI/dpYJe0OPD4sOi6xeDfL:zRrmZA4k6nQNCA63qn

  Score

  10^/10

  cybergatea76discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2