Extracted

• • Target

    cd851b37d388a1526feb84434ac13607_JaffaCakes118

  • Size

    457KB

  • MD5

    cd851b37d388a1526feb84434ac13607

  • SHA1

    898a4481b0c3dbeb539782902a7c7da1bd1142e8

  • SHA256

    09dc8085564b5a0dd6578939c0ccc9a775327599700121a6f37186dda3643cbe

  • SHA512

    ff169e006a9099692956111426c98932fbd72cdb84b524847f913c437ed865f8da47ee27b2a896b9ace2a400f21cf6e5dc2c8b64ac350f1e93a892995061c11b

  • SSDEEP

    12288:jM/U2QNWip1nEtvqI6xTMc6nOWhv7e4YRPnGVy90lVmUduvt9:EWEtvCTdYrw4YRPnGEy7zduv

  Score

  10^/10

  cybergatemodiloaderöííédiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2