Extracted

• • Target
    jaffacakes118__9ba35b7571601c76e88521bad0742423
  • Size 452KB
  • SHA256 9ee8275cb2cbb932f67c738d83524e37d4a0eb759d5c56a95557da0c5e429eb8
  • MD5 9ba35b7571601c76e88521bad0742423
  • SHA1 b904f8d4e4c563befff1bbd0f02977f50cb81895
  • SHA512 605752bae8d9256deb384102b1b196b6c546e242f772335848102d8fb5577faca858934857c861dc054c8cdc483d1ebd00d2ed2f888850f709236cc585a16aa9
  • SSDEEP 6144:G5gkXlTZhS80Ni0x8vFQI8P+iUB0XY0f2X2kl5hlkdSZ/o2KjV54OHAaklGEgvWj:GHQD+AXY0eX2oRkwZNkUacGHXUJPD
  • TLSH
    T113A4CE266B759D36CE6CFFB80E8E9779A4C04D156D012923109E6BF09F6184623FE07B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitremotediscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2