Extracted

• • Target

    cc1d492a772b8572c27edaa4c29e5d86_JaffaCakes118

  • Size

    754KB

  • MD5

    cc1d492a772b8572c27edaa4c29e5d86

  • SHA1

    ad4517b4e73ebf3af3257d86225ed59c4934a18a

  • SHA256

    eea8c8d5bf8af7086d54025d7ec4b8b9a0f22a7ac4a676f89adaba861575493c

  • SHA512

    4d70179c538f46b300df39b3ec563bb0c851c339f0a46b28ec3043dce08abff35a3102c9b6e894a557dc6f97953bcb4dafcc55c67dcf3a019b78ea7424d0e011

  • SSDEEP

    12288:0tAmKn831yUbG/cxetHcxPCNl4ZHpG0MoQf42y+OiFb13iJe9yY8bBzhlLdIQONg:0tAD/ckHcxPE+JWoW40fFZ3y5Y6BzRZh

  Score

  10^/10

  cybergatejavatestdiscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2