Extracted

• • Target

    48f74afe4d1d0e2efdc9c98c933e0119_JaffaCakes118

  • Size

    448KB

  • MD5

    48f74afe4d1d0e2efdc9c98c933e0119

  • SHA1

    547935db7e05d66d352d62fad1e8ae0b5834945e

  • SHA256

    7ae2e210877f162b0ad24aab57c68453b9ed92fe46291e7177a4594c8c0fa778

  • SHA512

    43dbaf92c3bcfe142927d5907d89c2fee71e79db2002dd1f0e57f53f4ec62e00e15cb7755a8fb0fb6fd30c270bdaf559d1955f513346996bc57bcd46d119e046

  • SSDEEP

    12288:ABhYm4KraNdfiLQVo3UbITpD83ddSAcgPRmXDaK9:AUAaLibUbIMSls4

  Score

  10^/10

  cybergateremotebootkitpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2