Extracted

• • Target

    515c47d89bd92a22aed269ee054c94b4_JaffaCakes118

  • Size

    488KB

  • MD5

    515c47d89bd92a22aed269ee054c94b4

  • SHA1

    b36a725484f0cf13a73fdb58bfa6a720689e6a8b

  • SHA256

    b26fd1955e0b42ac8e9f39144b681c3e749d3d84aafbd7ed62c8d5be8cb97d6b

  • SHA512

    d46e686c08c62d87ea82d8629f8f6e178a53edf575717b3e737a7d3edc7e9267982b17ad62254ab40a01973307257ae4e1454c21b570b98b0df8e527339c44f4

  • SSDEEP

    12288:uX3W3YWO9++GG2CSdhWHhp3lZn62wSfyLdHECOzLj4gf3g0P:uHt+UYhWHhp3lZn6oEHECsjP

  Score

  10^/10

  cybergatemodiloadervítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Molebox Virtualization software

    Detects file using Molebox Virtualization software.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2