Extracted

• • Target

    JaffaCakes118_172869ebef1f3f9e1a127664748a5a17

  • Size

    725KB

  • MD5

    172869ebef1f3f9e1a127664748a5a17

  • SHA1

    c521e0823053766f2ba3c1d0db263be0431609f6

  • SHA256

    ce050f82d51779b4dec18d38fe8e16d152b37a7b31382e7b5a4563242c93b101

  • SHA512

    daa0cd0eac81f803289c5d1f1132d193b02fc8c25a17175063c5fc981b9da27392774f37df17ffbd4308388f50cb6827c4dcb358d9024f27b34df1f7f785e06e

  • SSDEEP

    12288:Q4uPlcPwDF448CR9EA5Q+7nwFY0jAF6AkFBP6IxvfSEofkI:QJlcIDF2G9E9+7nw5y6JFBPnaEeR

  Score

  10^/10

  cybergatesimonediscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2