Extracted

• • Target

    dc4102860acb24a4ff8819eb99137954_JaffaCakes118

  • Size

    484KB

  • MD5

    dc4102860acb24a4ff8819eb99137954

  • SHA1

    bbd2caa9efbab22b3c7915d1e8d15926313303d9

  • SHA256

    bb01cb99860e17b60009a6bd2f5bad01ab5d7f7b44d0c87cbb6bf0ce99b59bab

  • SHA512

    da6bd519763a1097098a8dbc30c4570cce6795a26271fcc069d03d177ecc8508907d597e4ec60302083b4218e674501bf138c7f8b187a37dfab44b7d07c38ce9

  • SSDEEP

    6144:PG/FHQMiiImAAhwkQZsSfcQ+L3oo890Vk3mrdN1srVqj4wLPMSkQA/Vl1+iTy3:PcQMiiAAhwk5d83mrXAVqUIESfA/r

  Score

  10^/10

  cybergate[email protected]discoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2