Extracted

• • Target

    JaffaCakes118_467d4a49fe9c5ed094b0526e66068464

  • Size

    737KB

  • MD5

    467d4a49fe9c5ed094b0526e66068464

  • SHA1

    2fb0a248f75a8439f65e8fe20988133b6b50870b

  • SHA256

    a82f1d608f264ed409efcfcb650e231884c01fa148d67c21b2403da1b1234352

  • SHA512

    b636ac0873a98ba72d0ceb63cd138181a95806741a16162573bc587daa9d92e573570f3964b07bc742d83a9f0951f0285d2cadde7e7ffa892903e20d703d82e6

  • SSDEEP

    12288:7rf5jmH+/NsbM2TL8dttO5eGv0KpgvF2JRfloF+Mb0Y+BiMEiSJJnCtwn4IB0:H++FinTL8HtieNIg92JNK3qiME5bCOnK

  Score

  10^/10

  ardamaxcybergatemodolladiscoverykeyloggerpersistencestealertrojanupx

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax

  • Ardamax family

    ardamax

  • Ardamax main executable

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2