Extracted

• • Target

    JaffaCakes118_342565c02e16c4d053a2036abf732477

  • Size

    424KB

  • MD5

    342565c02e16c4d053a2036abf732477

  • SHA1

    d4451d573bdd866964e7f49cd4f8f26e8ee53b21

  • SHA256

    1226e3c8c6825088601c1907699d7d0d577e0e6752b19b9bb674c2a6fa4d64b4

  • SHA512

    3ed43993b7d621886bdec9b4a53ae75e677fb92b079d428dba9bdca9509fa2b91962a57c8f6d283693d6013f264ae63d5bd4c5540b10062b202966e7a041a396

  • SSDEEP

    6144:TodmIIFgadqT9NFoXXQ/czIfY7h7ZA+mqmCevnjnjpwFIcPPlzDgwO3:c8/gadqTdonQO37h7GJNvn/JcPtPgwO

  Score

  10^/10

  cybergatevictimabootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2