Extracted

• • Target

    JaffaCakes118_852598c087b93a500d4b2b7df1a06a17

  • Size

    380KB

  • MD5

    852598c087b93a500d4b2b7df1a06a17

  • SHA1

    3b2d01c381fb4a7097f4b7e354194f2d46644cb4

  • SHA256

    a5a60f924ee701ce356037a1a6ee84d71c20e4112c297d57511cec87c7734674

  • SHA512

    949954308ca224d0d7f779669e9035372a167470fb57069870ccfb0d9155ed1c265fcd8d19fea7d1f4d3c7b58a5cf6f3f9b1f72c192c04fce1f772c49ee77c79

  • SSDEEP

    6144:bF3z7Ls3CwM+kBDl7VXKaH2AoQZbGQ2MG+33zO3kYgOf/DrF7IRqo2SuCToWUG+t:5jSCwM+yJ7p1/LxzO3kWrF73KUoz

  Score

  10^/10

  cybergatecybergatediscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2