Extracted

• • Target

    JaffaCakes118_a50ec8cb378018d85fcd1d43ddc1a299

  • Size

    452KB

  • MD5

    a50ec8cb378018d85fcd1d43ddc1a299

  • SHA1

    d8b216fbc166de759815039249fbc45ee7e2d5ef

  • SHA256

    4f3f08128db471e2765e4c3edcaf3136ff5bf7d3499b0456b1ede57584533325

  • SHA512

    14c3ec91ce4fb034d131224445449793c0c9f461f7d1c7e2430214517b43b076528e809ef3f81a035827701bc826e0f92206fdcaa01f5eeccb75b7d57f199549

  • SSDEEP

    12288:4YvF2wJjRkULZTEq+r0rhG63FOd4D530ADzgBg5BDusL0:4fiZ4rIhGWCOEK5IsL0

  Score

  10^/10

  cybergateic16911bootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2