Extracted

• • Target

    ed1403be2939e0e1072922fa0bf4a344_JaffaCakes118

  • Size

    494KB

  • MD5

    ed1403be2939e0e1072922fa0bf4a344

  • SHA1

    bc59f5a50b2b2c2e298e309bb57a0bb185d16ea5

  • SHA256

    6866d8e049dac1480d976411f5fad37571ae09e21ecd3db48efb94a9e4d61636

  • SHA512

    7041ce1d8a3d77b1451f61f56b56ca57b2f2254a3e62a6639847eee9d3839f5f293e4b764afdb7e6dc6b49cdea5cfe5677ac894ab9e46ed146fa6b6fe83032c2

  • SSDEEP

    12288:HQsjaeNyUc+N0LStP4VmspYyiykGXeluBT0Iw5pH40:H9ro+NLP4VmIYyhkGOs6lPV

  Score

  10^/10

  cybergatevítimabootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2