Extracted

• • Target

    JaffaCakes118_6676d5d073a854e32505f06f2020d5dc

  • Size

    812KB

  • MD5

    6676d5d073a854e32505f06f2020d5dc

  • SHA1

    81bb7d11932a29f81647b896ff961fb4fc18abd5

  • SHA256

    25f18cab96af4775ea34927a4e2ae86beb39ac8255ecb4e7bd48d6dccac95de2

  • SHA512

    d07d4ab671abd11cd8af659410c34988cb71f29877fafd3c3a6f7cf9aee34457170af4afd4cf4403576342a0ab5dcd98c3a7c3caa92001880ca5af9c78ab79c0

  • SSDEEP

    12288:dO4x1GQZLlaIi0hB7EYXhX1KGTMT1A3/sVEsMkgzxLU6h1vyN84FvYUn:84OQZYyXhX1KGIq3kVFgNLPvy6o

  Score

  10^/10

  cybergatecycbotbindedbackdoordiscoverypersistenceratspywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot

  • Cycbot family

    cycbot

  • Detects Cycbot payload

    Cycbot is a backdoor and trojan written in C++.

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2