Extracted

• • Target

    f561707f06709a8503cdc38346186e15_JaffaCakes118

  • Size

    2.9MB

  • MD5

    f561707f06709a8503cdc38346186e15

  • SHA1

    a66ca81dc7a8c951e81f8c35991aea50ad6f67b2

  • SHA256

    ed100ce0e7768a91ce7c4079bcfa8a7a992369ddd96ac596c3b4ccda3928ab2f

  • SHA512

    e6d694bc2cb7cc37d43d1bc1446a7fc177ce172de3b8b2a64bc8fe8e0d06de1e3a90bc8539253abb132b7f715f6f515bf58e6c52b28793ed00823843e49b8765

  • SSDEEP

    49152:ZrH8O2skrn6zoEuVT7Y5XBLwTFh52pwB1eWpqba0uIpdPh4z1pd1y6yDGR/:ZCskDooTT7Y5xk7UpA/q3u44z1pNt

  Score

  10^/10

  cybergatemodiloadervítimadiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • ModiLoader Second Stage

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2