Extracted

• • Target

    f60ce44cd4c6bdc39f1d6403e9e221ac_JaffaCakes118

  • Size

    345KB

  • MD5

    f60ce44cd4c6bdc39f1d6403e9e221ac

  • SHA1

    afc9e449a9ae57997e4d0d6a822f6dba99ce9ca7

  • SHA256

    270dff779a2199e40e79264a961998e51ddca9932956b7e253a5721dd8b43c5d

  • SHA512

    fa62de0e325ae7a5d291c42e39fa44685af11e083f70959bef1526664d11f36680bc1d979a857cea8f2a50bc4be395f3c207893d5cd3e5af299dcdf30770b373

  • SSDEEP

    6144:q0JS/9ZkrBIOdAZCZrfbNqyMXzrlTabpHZRSk2kFhZ:5JWk2uAZClfbNqyM3Ibp5RJZ

  Score

  10^/10

  cybergatehawkeyeireformedidiscoverykeyloggerpersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2