Extracted

• • Target

    JaffaCakes118_6113772ae4a5642a2acc3d8e700c312f

  • Size

    2.2MB

  • MD5

    6113772ae4a5642a2acc3d8e700c312f

  • SHA1

    ed22ebdc6ecb59b2584f3d935c86923eefe909e0

  • SHA256

    d4c0d41972dd10949cd94cee76b33f1a6bdd8baf1bb9ad813058a375a7a4081d

  • SHA512

    16d8bf50bd55fb7baa7a4311d5d53b79948bc8147075f988b117a59a1c889f48183c3ad04aef872df716e39be1741fa26225d70c0f6e4bf7e2844b076fb08b24

  • SSDEEP

    24576:3JxEfQehWy4Bl9dwDMs8VuMDWxqYnFl+i14rTiB2hN7v6rLATL6j+bD5IkzBnlqa:5cf4/vgRv4C2WyequOl3puSuGgY

  Score

  10^/10

  cybergate[email protected]discoveryevasionpersistencestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2