Extracted

• • Target

    718ad7626bebae8cc1b75d723fae7058_JaffaCakes118

  • Size

    1.4MB

  • MD5

    718ad7626bebae8cc1b75d723fae7058

  • SHA1

    acd693347ce825d166b98ac3c1de25f32de802f0

  • SHA256

    84f40fa9d3831326b0a6e899566b1c49da57c7b4651e13cd856d5a7eb779ccf4

  • SHA512

    6297aa404d007546339a17930fb4fe66c18fdbd15c4ee565cd6e644e44f7d9af1dc277c637fe44ac4de8249723e575119494cb9cccabd476d566d6e781562b50

  • SSDEEP

    24576:22nNJbwdrIaThFOfRcmdq6vRhYFZMBMeA58T+1+KbjtuNdy819ErmyFAeG:JpYPhFOG0CeJ6vaV1ayyFFG

  Score

  10^/10

  cybergatetestediscoveryevasionpersistencestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2