Extracted

Extracted

• • Target

    JaffaCakes118_adf97f8492a8311df1d0598b3845d9b7

  • Size

    976KB

  • MD5

    adf97f8492a8311df1d0598b3845d9b7

  • SHA1

    6c372e4cb63b39e9368364bbc43edcee73d1325b

  • SHA256

    41044ea5f085251f7eeda1b3e6d691ea1e2de6d03bacea44ebc58f7a1b702efe

  • SHA512

    ff9680b256a2d8118c5a9ce0e07778bf48489c9413bcbdd3cf085f87d24080c3cc764cbbb316a6ce6dec86526652760bb26a32e2342e302055e9dfe342ec7761

  • SSDEEP

    12288:6WP5l52nYibaqkQyQBuEo/P/EUACbNMhY8hpWt87fHfrtKWYpKZ:6mMmq59uEonuCb0Y4pWkfHfrtKWC

  Score

  10^/10

  cybergategoziremotebankerdiscoveryisfbpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Gozi family

    gozi

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1