Extracted

• • Target

    JaffaCakes118_21474dfa6a54e2b3fab2bc5ec6667f6a

  • Size

    364KB

  • MD5

    21474dfa6a54e2b3fab2bc5ec6667f6a

  • SHA1

    cc05d2b59afaa334a42aae959d54cb7da6aed0c8

  • SHA256

    bbe7d9090a25ab2ec562bf8d8c6bad8a416c8bdef5a05e57582d685d0596ad11

  • SHA512

    f1887dd2ca29d4cf7c94a8c24d2b00bf28746e6eee6b63d2cbacca51615d2050ecb574586a6825003d7614c5d03d85f90efe614dc0bd5f661eca3198d060dd12

  • SSDEEP

    6144:YeaQx23J8IESKCdS1gH+YGrhRdGj0Mfq2bQFC8qJpyyLdH0lH:5aQ7SKy2gH9GrhDGTNbwC8qJEUkH

  Score

  10^/10

  cybergateremotebootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2