Extracted

• • Target

    7c8b6104389a5f84f5c1f05ac261186e_JaffaCakes118

  • Size

    1.1MB

  • MD5

    7c8b6104389a5f84f5c1f05ac261186e

  • SHA1

    ba03219af2e191180ae699c6c9050aadf43025e5

  • SHA256

    7846985695b70ba9e314cb98b143a3e31e53445853837b6c4864e7d3ed6f9eba

  • SHA512

    a52dce1676cc8942848016a2b8980a1f279e1bd64f4fc8608054016d5abd7f7e3d0566239358dfbf464871a4e016bde1e71cb2c9e194aad9926c92684a7d3e79

  • SSDEEP

    24576:9kodSyxubU28Eu74VKw+rj1vdFFQ6FNaY/ukmuhmHJniK90LP8sj:9k/70EuUMPj11FFQ6FNaE9muhmtiK905

  Score

  10^/10

  cybergatedarkcomet1865patchdiscoverypersistenceratstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2