Extracted

• • Target

    JaffaCakes118_a88389ba001ff68e1b0dbd689785089a

  • Size

    456KB

  • MD5

    a88389ba001ff68e1b0dbd689785089a

  • SHA1

    52c4aa5f658f2c3341bbb806ce27c7c68dd2d3fd

  • SHA256

    1c3ee14abc9bcafb0bf883c75753b0a517e100296388ccf55c389d3bce7099f8

  • SHA512

    3e76ccf70b16b3d3fb1ab1db791ed47303a7013008481113c0e390410b78825f77bf26e944f1c807e57f93187d45f3d3103e42ecb1309263db03e2bfad529917

  • SSDEEP

    12288:su+H284wkijvAbiMeXK1t6c1ZTGFsnkizSPvEMWSK:eIFyFk

  Score

  10^/10

  cybergatetestdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1