Extracted

• • Target

    JaffaCakes118_a84baabea308c949bf1e1a1dae41a359

  • Size

    580KB

  • MD5

    a84baabea308c949bf1e1a1dae41a359

  • SHA1

    a0f1a8b0b6b7ce1bae9d6709e1abb4f09cb93595

  • SHA256

    99ac103edaf3223999fad0faab5f82d4871f2a705a671d62cc54656bcfb6874c

  • SHA512

    cd491bef426bf0d5bfb2742989f6714465ea3be4a56d935e5787c7e6527f939cbbcc2e7fd026d7d98df5073bcd02fe1f7899f04136ad27d83ac29269bc08b8d3

  • SSDEEP

    12288:IrAj6YxbVAEqB4Tk8scKKEEdQIMF+8CMtgbcGGKQ0249nGet:IrG4v3+VTYe

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1