Extracted

• • Target

    81c89d08a7ac303242bd5e87a2b914bb_JaffaCakes118

  • Size

    2.3MB

  • MD5

    81c89d08a7ac303242bd5e87a2b914bb

  • SHA1

    1b693f74038d3167f6303aa37acf865d9fd9bba6

  • SHA256

    4a5d2fb149028f8a55f45968fae6ccc7444114deeba1489ee204608f8859f9d2

  • SHA512

    c6bd2d640874b1d140570cd7e1bc7fb7079b463cd8c0cec05313ea3a5e543bab0b0629ce263af1ba1d1a49385c3aa6a786d25cd22a1c7a9f7059117751850228

  • SSDEEP

    49152:/Ii6S9LX3ZzgB//JsbWUer67p+5B44y0fnq7wWbI/yEIrXY:/Fbp8BHJsleO7p+5B44xfnqk5qJXY

  Score

  10^/10

  cybergatevítimadiscoveryevasionpersistencestealerthemidatrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2