Extracted

• • Target

    d22304eae9ee245b39108447ce8a78f3_JaffaCakes118

  • Size

    5.3MB

  • MD5

    d22304eae9ee245b39108447ce8a78f3

  • SHA1

    6f569c1ef95284b21b3d724e810daeb571aa49aa

  • SHA256

    bdf85470093170e796789d73d5188ba01e9355539883f4803bda753073860718

  • SHA512

    b4e10c991f71c444153419d5485c1fcccb615b15f1b5ba7a1f92fac263570a742b0c1efa2226ba0a5ee48aff1c64f6a7e302898c21c8931d651a87141bdd2665

  • SSDEEP

    49152:gh87j4ag9ZD5IYmemK/AHF5KNM82/ZjmwITS3CTPJ4Z:Y8Ia9

  Score

  10^/10

  cybergatecryptosuitediscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2