Extracted

• • Target

    444672d96f4b5b8e2a8d5bfcc6834f4e_JaffaCakes118

  • Size

    945KB

  • MD5

    444672d96f4b5b8e2a8d5bfcc6834f4e

  • SHA1

    887d797e65152bf1ebea46841bdfedb1825648a4

  • SHA256

    150c5c6a596b1515649d8b1a43a5d5096d61a22ee38b3503c4ebe110588a5d60

  • SHA512

    78bb3424337b334aedd612b940d94cfc86cdad330d2daf67aa10690890da9cf7c91775c318b783ed1ea4ddf53c09dd89d1464d7c721a009df3607908db4cc98f

  • SSDEEP

    24576:Dnka/zWM63dUdUJdk/FYZIfDoV7sa9wrw:Dndz1CeQhWIP

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2