Extracted

• • Target
    jaffacakes118__b2d822ef22ce9be045e150ddb427a674
  • Size 452KB
  • SHA256 28f5d567c3ab96034833ac80c2f52deccc886f62f3069f44a859f9463c71024a
  • MD5 b2d822ef22ce9be045e150ddb427a674
  • SHA1 061c5158cc141c08fda76e3470490aa9d7932cd3
  • SHA512 8591eab8d2c8e741393540648fe8aa9037be5376b3e6fc1d85259c5c15fa818734f7fdabcf945febaec46fd37a73d858832c2c2963fe957fcc32e2bd2b018c36
  • SSDEEP 12288:fQsJi5IBPVik2y3lF3LCRfjBAfHWNiX9eWq1:PPVik2MF3Lku2IX0Wg
  • TLSH
    T121A49B1653B62D13FE3D6E3409518370F834A905A2B2D96E308D6F6B6D26A8F51FDC2C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitremotediscoverycybergatepersistencestealertrojanupx

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2