Extracted

Extracted

• • Target

    152a293cd0f69e54fdbe99536f615c0e_JaffaCakes118

  • Size

    276KB

  • MD5

    152a293cd0f69e54fdbe99536f615c0e

  • SHA1

    c561460f18073250dcd869cc44b4db46c06f3e80

  • SHA256

    5838d3649b5f496f3ef222852990798fe1e7b0719843204b3299608091273367

  • SHA512

    49a37fabbc34ba7de5d9d8d29a5d7626751260a9b00b59bd7a3df71802ab417311183b4c715ca4e1acd942af8b21e70e9112ff27831ac6e2d5264db2f9df6896

  • SSDEEP

    6144:pk4qmXrcCYxMyR6hWV65Ielz9/b5v4PRDm7lDF4mw:u9gq6hIaz9FQPRcX

  Score

  10^/10

  cybergatelatentbotvictimapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2