Extracted

• • Target

    ec50f6c14aec01fed609b344eaba9048_JaffaCakes118

  • Size

    1.2MB

  • MD5

    ec50f6c14aec01fed609b344eaba9048

  • SHA1

    1f8e6f7aa1c8c02406ba223d5c5e1502a46cc66e

  • SHA256

    f9fc30dd4357b7e414474904c7702d4a51b4ddfc7f9e0157271cb0ab2ad28de8

  • SHA512

    c2020b42eed95a47edba6fae6c5549cea72bb0f0b61604658c54956d5e260868ab6e800462af845369d56e905915016dcc8d015f6a8abf9f2b5938e838fe9861

  • SSDEEP

    24576:3NNZOklHT/o+6jboTdIJvkceI2X/QlSj/RruFV/PjL6Swr+aly3MjUsg:9vOATasTitSb1Uxql+aQ7sg

  Score

  10^/10

  cybergatewebcheatsdiscoveryevasionpersistencestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2