Extracted

• • Target

    94cc01ca1e2594b1cf89b585fb38c68f_JaffaCakes118

  • Size

    704KB

  • MD5

    94cc01ca1e2594b1cf89b585fb38c68f

  • SHA1

    14ccf94fcd1840c9c350ea87624263c468f14928

  • SHA256

    933ad9a227732b7e7fb14d5ac0c80c7c0634dc0e9e649523363dad2c1f82a513

  • SHA512

    647a4a7aa236a5d7286fc48ea07da94f2b0c0361a9b951a13fbcfd22040bd86e67b3e6995a2d5e2951425e44772c91374ebc4abe369ef4bf956003f41fe2d50e

  • SSDEEP

    12288:sH9W1yAWkyRKJqlk89oY4eGZ7KTVzYKj86s3q9Pz4fJ:s5zFKJqaY4tZ76pYOAQ

  Score

  10^/10

  cybergateremotebootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2