Extracted

• • Target

    JaffaCakes118_adfaf34757c6a8865efd25bfdb924fb9

  • Size

    773KB

  • MD5

    adfaf34757c6a8865efd25bfdb924fb9

  • SHA1

    f2d57e5eaf6b5932aad0611f3a09888e80a595a2

  • SHA256

    52cd8f77ca99636f47393f230140b2d3916f9e60b9692f8dc6fcb2ec369dfe1e

  • SHA512

    e529e436007de94afa5e58ea7f02f8fe5654f25609c076cb3a3f11e7476e6f85c7946cce833b30d18c8f5ab979578112cb5c6c29f1f51cdd9219bdd568c47211

  • SSDEEP

    12288:2Rdrkltek4fuSVSyEwQFl380z6m30pqq32aJSEt1VtkiSpj6E5x5NWYB4Y9g77Aj:zcGFEq6g1MKJdOH/2Y

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1