Extracted

Extracted

• • Target

    ece81d88a1a4e989ff87646ed7be01ff_JaffaCakes118

  • Size

    1.0MB

  • MD5

    ece81d88a1a4e989ff87646ed7be01ff

  • SHA1

    3e0a38712625dd9e84334ddc96705260ea8a6e0a

  • SHA256

    c18abd79173187048b49b85acddf1ec9632ebe5e00d3389974bcfb76ba244619

  • SHA512

    070bfacd24fe5f55416363726ac182e0ee150bf3036162d49cbe7835e521b5de18f3a75e73d01feb920fbc1b2a1dc31b01d1c2f5be42c2daf7d8a5238253b9ed

  • SSDEEP

    24576:lFfTEdyRzFIolAvFr3rSnLtum+O2b/Fp5lXfAgT1Vx:lFfTEdYzFhlONm8w2Jp5ZImVx

  Score

  10^/10

  cybergatelatentbotvítimabootkitpersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2