Extracted

• • Target

    fd4f773b12fd7508b3659d72636e15ab_JaffaCakes118

  • Size

    907KB

  • MD5

    fd4f773b12fd7508b3659d72636e15ab

  • SHA1

    350c3d925be1911ef265ab82a395f7559eef9f09

  • SHA256

    a61b6bd896ba84178216a0d941ab46eff1d6c9cd222bddcb4a6a42982a8bde72

  • SHA512

    78f9af4da21a904e5bea8f997d4b29736f0bf9a16f3061a989c45e101a9ca4ecbd6fc986b34b610fed1f262fce50a093b97d9fb026668865800f790825b86aea

  • SSDEEP

    24576:M4Yq33GThnz/ShKZxvoi4PQ2eR2ij4fXdB0j:1ujZZx0o2erjUtQ

  Score

  10^/10

  cybergatedangerpwnzaspackv2bootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2