Extracted

• • Target

    JaffaCakes118_46e86f26151b58b4a81115a8dc2679b9

  • Size

    640KB

  • MD5

    46e86f26151b58b4a81115a8dc2679b9

  • SHA1

    43f0e29c5cb4f842615379f8da8f1510a682dba6

  • SHA256

    f7933ba69417438e7840cf31d0d69342b6aa0ab7b66ee14adbe33c989c944703

  • SHA512

    035c66b229e607037b63a1c5e720d90b6e5ac02d00251b82ef78dbc510c96a2320ab094f27ecec34bd248ab0c6edd91d3615c8d45f631c66cdb1e56cf1138a87

  • SSDEEP

    12288:qW6FgGphtfu2Fo5d9aoXMxOVL5X7ZgS82SgfWNo:qW6FgGVfu2Md3JVt7Z+2SgfWo

  Score

  10^/10

  cybergatebeta test !discoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2