Extracted

• • Target

    3e6f8a2620ad9ef64265bf4a43a9473d_JaffaCakes118

  • Size

    525KB

  • MD5

    3e6f8a2620ad9ef64265bf4a43a9473d

  • SHA1

    66127ad536a86e70929ba1b5152a66c6b338aed7

  • SHA256

    581519db2eab1c49b41c1903d743d545d93023cb08f81573b6eaa33a7f2600b0

  • SHA512

    cea6129cb7f7f17f549e62d41321cf73adea4a3a5f5ebf82f2be58eeef54bbaa8fac6ba23116fab4178b5eddd77a9fb643639dd3edb935db7f728b5c61b52bec

  • SSDEEP

    12288:qMqP8Tw6b7MP+Dd27VyKUkx0/ZojJqRelzh9:qMY8TR7MP+h27kxBo9qRe1h9

  Score

  10^/10

  cybergatepaciottibootkitpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2