Extracted

• • Target

    JaffaCakes118_6f68c37dca6d739263c6ba55891527d3

  • Size

    1012KB

  • MD5

    6f68c37dca6d739263c6ba55891527d3

  • SHA1

    2e8e7361e3f96bda7dd9079e942af93ceb7a16b4

  • SHA256

    524bf6d2998cb2c82807f2721bdf2de32a596074ba671a32d817727d599dac20

  • SHA512

    f5411fd41e3e84b5bb4eaad21a82e4eec5d5deb85c212316ef3edb64412180d97769b6037af8ca313f257d411f4a70aad884fa128e34ebcc247b4edc1f38de7c

  • SSDEEP

    12288:UcZlUiiOzB621frEVJy92pRXH2J3ySUSXU2yKHy77VOBifb03Ea2oGjqU2U3hszW:X4InEVSwmJNUiBSvVnAX2l9bvSJYOe1

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2