Extracted

Extracted

• • Target

    JaffaCakes118_7689f19cfaa266509bbf8c17d544cc1a

  • Size

    2.2MB

  • MD5

    7689f19cfaa266509bbf8c17d544cc1a

  • SHA1

    428cb7224d6f40c635fa31b567e7fbdd2d2813ee

  • SHA256

    3da3acc0323e5ae77c1f28640d40e0e5fff3398f726b3524802aa7f7661e83af

  • SHA512

    46322ded7f0e284ea7a4c60a21bae7d118f15987a8d29a2e0c2fb50f267233c78d3e149f368c65c665303c16a55370d1badd10f585f26a35180feb0ab517c7ef

  • SSDEEP

    49152:Thd7qM6yoh+nV0+YRsJSu0vpoipguKnH0Lz:6M6RwMsEpgFH0v

  Score

  10^/10

  cybergatedarkcometguest16remotediscoverypersistenceratstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2