Extracted

Extracted

• • Target

    07b7165bd3707e09f20d491ad7e851bd_JaffaCakes118

  • Size

    306KB

  • MD5

    07b7165bd3707e09f20d491ad7e851bd

  • SHA1

    98911c9e3d2273d7a30e31609daacc3f3d29b119

  • SHA256

    cc2d1e788d98cdc8c5e69b2123d5d3dd9e1adf14f7194454147ef765ee7dba6a

  • SHA512

    c534d3683e623002edb7af49ba5b5a1455f75fa57917eea7b5bb265dcde802d1e0efe654eb579cdd1c8466e53c31103e650e52af0c6377e724331cd90917d363

  • SSDEEP

    6144:WBW5nVTPBAxL0oiUKinILgvc2pU74hCyxGZqNJGqJoPF/XbgXRvmS:MW5o+oTKv2pQ4Fx/NJXQ/bivmS

  Score

  10^/10

  cybergatelatentbotvictimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2