Extracted

• • Target

    JaffaCakes118_0774f71a652a291b158f55795857c4a4

  • Size

    1.0MB

  • MD5

    0774f71a652a291b158f55795857c4a4

  • SHA1

    44d458ce047cf4a73245cc54745f777e7646bca6

  • SHA256

    031dfadf817fe9e5b4cc89f64d3aaf572a135bb3394c4b212c4af07632590f4e

  • SHA512

    019910d827c4d9ff08d20fa86cb3a3746ad0605f3e738f3a2ed588f3d83fdbf5466231510bc2df42acb09778ce967ffd8b961db7108840cf844886544131446c

  • SSDEEP

    24576:bEWzXPcpUlq0p+HaPArMmTP0U/0rdJPPnjfmV/bW9yh6e:VL+UlN+Haow68U/SZbk/Sgh6e

  Score

  10^/10

  cybergatethemidadefense_evasiondiscoverypersistencestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2