Extracted

• • Target

    5c2dd6e4760729c4e6ccba57e5c53dd0_JaffaCakes118

  • Size

    4.1MB

  • MD5

    5c2dd6e4760729c4e6ccba57e5c53dd0

  • SHA1

    8b4f76990354a9fe16b4e8c4fe459dc9aa67b9d2

  • SHA256

    ebb9d7e696ce8693ddeceba00f377d0d668010eee4755f71771027c21c4af6f5

  • SHA512

    e479c858bb27281567ae79c9d3f7e505db72c7af49c5675fd2980d39696a82d59bcbc2c260a27f830992644f53384698e0e06bff149bd991d8f014157b98e05d

  • SSDEEP

    98304:xUS+UpfIpZtN9DwAefvGsXjqD7+IG7Jyxz/xM3+A6nswaXzVJvV3m3:xAUWpPNBefvM7+/Org+FnGXzVJG

  Score

  10^/10

  cybergatevítimadiscoveryevasionpersistencestealerthemidatrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence
  behavioral1behavioral2