Extracted

Extracted

• • Target

    042b2c4869c741d130e9576efebe03f1_JaffaCakes118

  • Size

    376KB

  • MD5

    042b2c4869c741d130e9576efebe03f1

  • SHA1

    84b62b99152f30010c675bfdd894e745135d0340

  • SHA256

    14c1f213266cb0fd1ff8b71cfa6a57e62ac59444e998ad68dfdd42c84b1aeac5

  • SHA512

    f5f2e7f0d81ee8ef52104c3966e18aef6835d073016980722120ec29becf497359f4ece9115aa188ee0756926f57934cf81365c6b32acdc970042641a2fb8238

  • SSDEEP

    6144:cI3oTez8FdHEXHBuJV/wi25/WbRlEpeM/ODb/bQhS+UM5c3o2xdRvvd:cI3UzFZIV5/WbRmMD0SxM5A1l

  Score

  10^/10

  cybergatelatentbotìàðèóïîëü555persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2