Extracted

• • Target

    JaffaCakes118_9d78a6ec539d506682b52a23563600bb

  • Size

    512KB

  • MD5

    9d78a6ec539d506682b52a23563600bb

  • SHA1

    24616d48032dbe0b81f52d86eced003ab20450fe

  • SHA256

    43387531177cac41eeef73984168181bd6fff9eff55ca5586c48209762ffa1dd

  • SHA512

    6aa8ad1bcc2516bc8b911f6fd52020dd4adc1d61e52866941379a626168573d933baa99d020701e498a147c0bee28d6f04e1682583b2f188f09dfe776ae2539f

  • SSDEEP

    6144:WfcSoop6wfCGCY+t38SFYib0MZ/ajdf8lJSLl4wG0rzCOFYHA6B1UmNpmA1:WfCop9C1MSlb2gSSdCmOuHA6BdOA1

  Score

  10^/10

  cybergateremotebootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1