Extracted

Extracted

• • Target

    JaffaCakes118_ca12b63f9130e71a1e727d215a92851d

  • Size

    2.1MB

  • MD5

    ca12b63f9130e71a1e727d215a92851d

  • SHA1

    fe183038bfc4667d33dded16f61a63277b7c85a2

  • SHA256

    c61a18b416656f191847895bf5a9f077b060796a53ed3e04fa9746319b74708c

  • SHA512

    709327a3d66fe6e499165721aa4cb11ba16c2095f8348c513c7da2b2851853f52c3d6592d08f2bdb89578408c976d795d01a01b1f6907b81fcbecda4e50d6c54

  • SSDEEP

    49152:RN5y+qrOk95MKKsMHMa6SpB0ghmpnTK/q6w0Xkjgru:RrnhGaFHl6S0gAnTK5nXkjgru

  Score

  10^/10

  cybergatedarkcometgnid0sguest16credential_accessdiscoverypersistenceratspywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2