Extracted

• • Target

    JaffaCakes118_885079490c76b8675c1d310f9d177946

  • Size

    929KB

  • MD5

    885079490c76b8675c1d310f9d177946

  • SHA1

    1c1cfdf54c3e49a13a02967afcb8a9918fce7722

  • SHA256

    887e635b2a1cb136d193d22342601e7896e405ea69f66a93170054007c7572d9

  • SHA512

    fddb21fd43c040dd4773e8f9f0f6c4906b33e6b1a50f30b797d0f8cf325f65a29c249488053a0592379387b27de76d3d4664bb4b6ac4b35d578517a5fa97659b

  • SSDEEP

    12288:ReZBmPZrcl6+8vCWmMGFUC3SBPOFAfJhgltNt8JIrrKBX6Roz+pnJFSxB5R/P+kZ:LcbrhMKj3uUJjGxWUhN21QoY

  Score

  10^/10

  cybergatecynodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2