Extracted

Extracted

• • Target

    31fb64a31bda2cf2492d814065bcf2af_JaffaCakes118

  • Size

    292KB

  • MD5

    31fb64a31bda2cf2492d814065bcf2af

  • SHA1

    d98b24d3ada94257540bde85a020d5159228eed8

  • SHA256

    d7633d00d218123fdfb2fb067b27a0e75feea3572cf503cae1719fc21279a46e

  • SHA512

    9a87c24afedf8dbbf776a9b1fefbb72e4873de34da08d99d6e639d82f8340e3d0c6775a6e6d896dc68150c44ae9c5111414207e9f52367ac7e402d92096d4f6f

  • SSDEEP

    6144:qQwT8/q3c66q8WRv6pZYfCEyr76riMJILWawPo5v1pWp3WzkBt1vQ:q+S3c65ypfEyrQ9JFohGWAY

  Score

  10^/10

  cybergatelatentbotspypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2