Extracted

Extracted

• • Target

    648654aaf3ee6b2be979d5ca6d1e5383_JaffaCakes118

  • Size

    1.2MB

  • MD5

    648654aaf3ee6b2be979d5ca6d1e5383

  • SHA1

    443cdffcd94bebee4566dd1efd8f8ada6e1e3220

  • SHA256

    93b90cb13f098d0a1ca9975d6580b53151b665ff05d85d8901bf2cbec7172ee6

  • SHA512

    30f4ebdc42c38c842cd4bc09615a41474e04e475a598d84cb6521d1ab5e6cfa77676bef2025aae3220a15c51d51edd7e39bbae10154f964345c359ee0056b19f

  • SSDEEP

    24576:xyc07Mk4qhN/yG/SpQ9WL5C+81r2UR2vA:8jwkWdXUb

  Score

  10^/10

  cybergatextremeratvítimadiscoverypersistenceratspywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2