Extracted

• • Target

    b4e111f5e7b8bec8152daf0f4320376e_JaffaCakes118

  • Size

    351KB

  • MD5

    b4e111f5e7b8bec8152daf0f4320376e

  • SHA1

    a6a679c7cd33eae62e76cc227434b502d50e8da3

  • SHA256

    b33e328d9725705e4936c24b5cb7626d0474ae2664df3d3265cda5f74999d0ab

  • SHA512

    b1e9877b539fa915284f864a03a9868c240ef3d5f74e54fbc7b825a131d223b51a96d918ff21621f4bba20298415239be6689042c62b3f2484515f3f43b96ff3

  • SSDEEP

    6144:oNL7da4KWd7CbOqKQ4OefIzUiu86MdmiNdmSEZD1FY7ySHpxl3r0oUSBTl79Q:oNL7dh9C69Q4XINzNz4Y71Ht3zUSB/

  Score

  10^/10

  cybergateremotediscoveryevasionpersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • UAC bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2