Extracted

Extracted

• • Target
    jaffacakes118__a52524d4d7f46b54785434be89bf5443
  • Size 347KB
  • SHA256 d7348e3ee61904493c4d686509f82d1a28f1a84d4cb04d9d35a622027b5667b5
  • MD5 a52524d4d7f46b54785434be89bf5443
  • SHA1 03013433ffe0d9bdc1080c07cb4ff1cc3fd3255b
  • SHA512 812fdea3ea1cb53747781426c5bbccb42ef800b47b00c03fdf151404412bde1292375dc86883682b92d5721d123439a27a1b9ead78bb0f3d087080d4516f7a8a
  • SSDEEP 6144:WMIxIVANytfIifoAi/CM4+vmMRhxNvU6A/r1igZQULgglO5cXvI:WbxIW0tfIRA7BP8FvVAJ6ULg8OIg
  • TLSH
    T1BC7423073E09BA8EFA073DF0591E7B945A023773161A77251E36D561E4B28C8C985FCB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorimadrapdefense_evasiondiscoverycybergatesalitypersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2