Extracted

• • Target

    JaffaCakes118_9c2c6c41351d0c01b3ac3ff5569cbd4b

  • Size

    1.5MB

  • MD5

    9c2c6c41351d0c01b3ac3ff5569cbd4b

  • SHA1

    3025388fd48170fd1fce115e40e869d0d1691a77

  • SHA256

    2bc30084a3aecc80cc8ebe5fbea0a4db6d24e17305a982ec38d429ff3a39a579

  • SHA512

    9f01982331e726c25454c5cb17e4ce3972b6fe964476a6fc37564d93ac9c90404b796370cf396b9a7402be0d5d4f4c37f83604ac89f6bcb57ef2a18b5787335e

  • SSDEEP

    24576:glYX0FaQIN7tFt39eZDE+WUHf0RMDFuW9aYCo6c1ASB:gykFaQyRezsWsWx1Aq

  Score

  10^/10

  blackshadescybergateremotedefense_evasiondiscoverypersistenceratstealertrojanupx

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades

  • Blackshades family

    blackshades

  • Blackshades payload

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Modifies firewall policy service

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1