Extracted

• • Target
    3e09a3c3a3f7b0b70170d29821c29f86_JaffaCakes118
  • Size 2.7MB
  • SHA256 efa1f68bc8d9bc301eea076291c9540202f929fe7d38ebf39dbd76c90922fea5
  • MD5 3e09a3c3a3f7b0b70170d29821c29f86
  • SHA1 ed01afdb2a09937f972195f7290ec6843d3ee45e
  • SHA512 118dda6ae6c7a8c5eb3984b7e77bd6afad5c72e59940a0392bee4cbb7ccc74b6c6489601140661317acdd1ee8dcab6168a3d75ec84229a577286a89905212646
  • SSDEEP 49152:yS2AoH6P4seNue+URWbX+9+sdONZAL0kJbZQefMXFAsx07L2GyTYAHc+:yS2Am04lQol9tYNZ8NZS1Vx07zyX7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cybergatevítimabootkitevasionpersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2