Extracted

• • Target

    JaffaCakes118_0f0707b73648b7a68847880ab8c8ad30

  • Size

    428KB

  • MD5

    0f0707b73648b7a68847880ab8c8ad30

  • SHA1

    d45b0b3c70ca213d700aee087dbfad162365e637

  • SHA256

    c236b1277e153aad36d5130d8f57442bab00d231de9d94e9e3edfa83104597fc

  • SHA512

    727bbd6b16a77126f36d0d5c531d3916bcd6e3c8e1b025c3bc42d73800f09f61c6149a0449a0ad9099d4b11a1902f80625d648d4f7ff66e6adda97e25ddf238b

  • SSDEEP

    12288:tbfD9w8fUb1waU2pjsEZF0YJTfAfSDDgcPoMCklFUXskZwoQQQR:trD9Hewab0YF/XP717UckZwoQQQR

  Score

  10^/10

  cybergatevítimabootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2