Extracted

• • Target

    JaffaCakes118_8b2b3e734d448c4f765c9486e720ae80

  • Size

    2.8MB

  • MD5

    8b2b3e734d448c4f765c9486e720ae80

  • SHA1

    58d4b6aeff37e40dfe73cdbc4b06007e2e1f5bfb

  • SHA256

    251f12028df54d184f3e24944a1a7834eb2d9d333f7ab5e3c61b9bbddf2b2a2b

  • SHA512

    1e4d9e92077ea2c46488b2950cf954c33c65589592df7ea5cf9ac1e63351a589b94d447a38502fd5354eb3d8a87e9449ea63dc59b1720f3c6f328ec5b4d815df

  • SSDEEP

    3072:iGFKquYf0tG2YR2PWwzhh3dODlc6ru6/P9C2qMRXv7Wbx6Mf1rbVLsIQb2Oz4n0i:iu3mG5G0lc5GS14VgCI5

  Score

  10^/10

  cybergatevítimadiscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2