Extracted

• • Target

    1fd994e2f8d192a07fc2535bcb28f1d2_JaffaCakes118

  • Size

    473KB

  • MD5

    1fd994e2f8d192a07fc2535bcb28f1d2

  • SHA1

    ee05d8c73ab635ad73de9e806888695dc76bcfb0

  • SHA256

    ef094f6f940a5f1738327292f003f744c76bfb7e0708e998ceb5c11c2e8a262b

  • SHA512

    d443697dc60f9b3457e41644bcf177e2a76157b861fa7c2aba4af01882d6d8722d7bd0ae7f826932860d622864a82d4471857d7754ed38db13bde783d52c6fdc

  • SSDEEP

    12288:nE3ht/aA9LIM/E9ihZlrXFGv5xbNN3hY/0Dn:EP/LhECFGxxbH3

  Score

  10^/10

  cybergatehawkeyesonykeyloggerpersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2