Extracted

Extracted

• • Target

    JaffaCakes118_7a981ecc0c69c3f6cf74b58d32eb6097

  • Size

    545KB

  • MD5

    7a981ecc0c69c3f6cf74b58d32eb6097

  • SHA1

    19a19e046523ef980250c828c4679267c3e46bd2

  • SHA256

    c6fe9e76af5ecf62ca0c220fa94e53d8e9c18ee4a585849148668f4e303cf45e

  • SHA512

    45f5deb78a4cbe5b08bbdbed4848ed186d5ee53c3880d0dab115dacf9bca1e0a643ba8d8c00cd8056155b75b6c6cbbe5982f59b7b91006f09747831e51e7d269

  • SSDEEP

    12288:Rp77UL8TQin9XRc2F0sq9eL3YM6+qwIg1MVwlGuyQmsu6qV8Rg0:XHUQTQ09XRud9eL3YOqwIguV4GLQPUaj

  Score

  10^/10

  cybergatesalityvítimabackdoordiscoveryevasionpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2