Extracted

• • Target

    JaffaCakes118_e1a937bba02204ed154df8ec791159d5

  • Size

    851KB

  • MD5

    e1a937bba02204ed154df8ec791159d5

  • SHA1

    0b2032e0bd11cf359ebbe320a1a1ac7851fd8162

  • SHA256

    4dda1fc6e2bdc7b5bb5a2c83e5c5468f76bcd23ea0a7baa9e0bd4963d33d8957

  • SHA512

    cd6c1b3fee7154bb540a2aed317cb4413a3273ee3c3fd8d8fe6785d8b1b0f9a35fda53766536799414ac3b0381fbaaff0b5925c2bcddb532da65a6a3122e77f9

  • SSDEEP

    24576:EwQkTf4Nkj61g6R7eJzlnmw1KAvsCw1mItFBJYrIqs:2kTgQ61IlNKAUZtFB6rRs

  Score

  10^/10

  cybergatebackdooreddiscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2