Extracted

• • Target

    90ce470d54cea1e49af866b5f196ebe6_JaffaCakes118

  • Size

    1.1MB

  • MD5

    90ce470d54cea1e49af866b5f196ebe6

  • SHA1

    651b526fd7d46c5f753a89e35d9d6fc1cc81a6af

  • SHA256

    cbfe827efbbed04ab62035c15cf85cffcdb20b60c99252448e1f0c25c768ec34

  • SHA512

    312df3b37c7f0bfa9e36c5cba6bbe9d21923824d5407fa46beca37192141d9e4b2b245d64dd855ccdaa5340899c39a3c8b58e9273d48a2efb1d9479756314ca1

  • SSDEEP

    24576:zS79Ah0gksWJCUqfbcvQ2m7XDlyPq4MFtQ6h:zaDsbcuDlh4MI6h

  Score

  10^/10

  cybergatemodiloaderåêáñ çáïãìçäídiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2