Extracted

Extracted

• • Target

    0e75bd63a8758981b03cc6436339e2ae_JaffaCakes118

  • Size

    1.0MB

  • MD5

    0e75bd63a8758981b03cc6436339e2ae

  • SHA1

    e567e3645721296c23159f3b42258be5611ca729

  • SHA256

    3df4065f1402791df276957eee37edd2eddce79df67aeb274d0da426b01e6cde

  • SHA512

    6647e0fd3c7b83b5449841070b246cd3ed6c40a792863ec43e2d1510497fda8b1c6a7b686a6e3dc6567e067d495498a376c49faf2f2f78d1101af81911451362

  • SSDEEP

    24576:1pqW/xLv1cRnxlFCwoOUgYAzopXFYFAh:nqW/1v6xxl5ocSF

  Score

  10^/10

  cybergatelatentbotgla0402stealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2