Extracted

• • Target

    fe922df3184e30631e432e6253484975_JaffaCakes118

  • Size

    395KB

  • MD5

    fe922df3184e30631e432e6253484975

  • SHA1

    57e285aaf6622cc32a4821ac3c0bda28f7c7440c

  • SHA256

    31bdba313beb84ea616dda0ce26e594bcf2ccb097b08a7d0d331feeab5a9e4f9

  • SHA512

    bad9e14c8fa19ebce0561f95a99f5d076ed985e1cab5a800810c1d318100553247eb5adef8d7520c608a2258ea4d1c60bc337bb3a3fdcbb56162e9af93f5759f

  • SSDEEP

    6144:sltMdNvlZk4KBmXaORlVwnZK5VTHOtHS2NtVbwyPOFfonVW5GJZ2tNYLj8Mfseyb:w6TkzmKObVwZwVLpJyPqwVzYKj86s9V

  Score

  10^/10

  cybergatenottbootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2