Extracted

Extracted

• • Target

    164386d2a4db76aa22abdeb48faae3c5_JaffaCakes118

  • Size

    308KB

  • MD5

    164386d2a4db76aa22abdeb48faae3c5

  • SHA1

    fb9079eef8d485bf3637e145ec98777ff822ec74

  • SHA256

    e6a0db4a813067c04d70bb34a865105604bac04bd83ff86147275864c6c21b9a

  • SHA512

    a2731528d5954d590bb4da3528eebe1114b5bb4e22da1e22c87c727be91c8069453f1c97ac069d8d6e741adbf146cdde6d7ee8f994cb32b3282a3a8d9fb8273a

  • SSDEEP

    6144:xrkZOpkhpxXykmoBgGRMJhuDP8+HFX0ld+QzUIh5Rb4cJn:Ww8F5m+CujHFX0lVzU0E+

  Score

  10^/10

  cybergatelatentbotincomingpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2