Extracted

• • Target

    JaffaCakes118_605c4c1b1efe9e918bfe108cd2e437a8

  • Size

    484KB

  • MD5

    605c4c1b1efe9e918bfe108cd2e437a8

  • SHA1

    71c95ab246cb885786c22c731688651156f20342

  • SHA256

    119641ac275c1ebe4225f250d4b2bd33d2f499339248ba007f1c3bbd69f1a576

  • SHA512

    38971a82baf46c3dfe48d48f2b3ffda13be5837da2d06a5d37b29d1d7115a566b5d9b2506029241cb5405bcfee9da714cd745af1f4245556894384699aabf15b

  • SSDEEP

    12288:aAIFWWXRqnSdkZHWt8iBD2rZwWyG9cOyJ5OK4Pd:2Vu5iywWlc/JK

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2