Extracted

• • Target

    JaffaCakes118_b9001c74b1d7c7d7acfd966c836edfc4

  • Size

    888KB

  • MD5

    b9001c74b1d7c7d7acfd966c836edfc4

  • SHA1

    30e5440be54e939e22597e01ee76eb91230b014e

  • SHA256

    4d8d8fec3469ac76a727ea1deeaed0f505b40349db15a3bf9c30f1231afcaf9b

  • SHA512

    5ae7eeccbfb40d5c3cea1a7542ff10eb40d8e61d9dd159671d3be154b689a20a8bc390a4eca50124adf3a4ec3f1659951870e08372a3356d07cbc2f35ca0eb3d

  • SSDEEP

    12288:E2fdTKjb7eZYaEaY9gJUx5qNMCtVugq52BbyTzuFH+7OdOGsgqHAL:RfdOjb779aYv5ROVxq525szueOd64

  Score

  10^/10

  cybergatevítimabootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2