Extracted

• • Target

    JaffaCakes118_8afbc12a8d691e2d8b556afca739bb72

  • Size

    1.1MB

  • MD5

    8afbc12a8d691e2d8b556afca739bb72

  • SHA1

    47e61f9be7c247364c2f7f566ba60a0653bf25de

  • SHA256

    905ea67b8408c3a9ba9e4fb63134207bfa3b380b0b2388c21752c5e5cb4d3222

  • SHA512

    3f1fc34f475c6ecd0e6bee20185056ec185f0161682a8e729b6ac09c1d1ef2d5c03c52a470803ca1c6ca6979044679d4a68aa8e2b5216a1fe6ac2b30f697e5ef

  • SSDEEP

    24576:7EJnxVfJnxVp9OklUxxYnzmDIN+hEJM6QlXJiSh:oJxVfJxVXOnxYnz9b+1

  Score

  10^/10

  cybergatevítimadefense_evasiondiscoverypersistencestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2