Extracted

• • Target

    JaffaCakes118_0bd1a2e78c9cd2dfc0a1b997b70edf1f

  • Size

    372KB

  • MD5

    0bd1a2e78c9cd2dfc0a1b997b70edf1f

  • SHA1

    edce8eb2311f60f31f38ab1bb8cd5aadc2050a64

  • SHA256

    1e82cdb882b3681a34ecd834b2715e9b0dcd5102c23c8abaffc36018aa6f66ab

  • SHA512

    5dd02af16d577969fa5a9e83232d7617ea63d0dff6adcc5fd3d4205ae0f648b20a2d3ff78a4e11079c12a215f087bb378972856093bfcb7771bee491930b2dc5

  • SSDEEP

    6144:7pGatfLvJz6CyNn9P79IXODs2bImlR9mwdy27ioLwdeU4YrKZSbL:FFzON9PyXODs8RTmU+iOWSbL

  Score

  10^/10

  cybergateremotediscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2