Extracted

Extracted

• • Target

    227f358c03a4596e1e1cdf5551f5bc74_JaffaCakes118

  • Size

    493KB

  • MD5

    227f358c03a4596e1e1cdf5551f5bc74

  • SHA1

    1f8f814415a83a92c5d48ca204b7d146bb8cbd1d

  • SHA256

    c67db068ab3924bafae2185c5b28ac5a0abcd4127f4bc3de06699091ce030869

  • SHA512

    c5629ebda9c17c69a9492cda1a0993267c3c67b9ab267e8bda93d802025073c07f777512ddad3e69b00fe2ee0932df3aa3fc026049d5ae3164beef3ea0bd6ded

  • SSDEEP

    12288:JLzTA0Cp7x9yDHrr25LDRrcZ3YUkP5fo/WnXPH5VBOHX1VR:tXS7eDrr25Ldrl55D/orR

  Score

  10^/10

  cybergatelatentbotremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2