Extracted

Extracted

• • Target

    3b060aa6c32567b4118c0c1c5c15cc8d_JaffaCakes118

  • Size

    352KB

  • MD5

    3b060aa6c32567b4118c0c1c5c15cc8d

  • SHA1

    2f10de5fa2a77c462ad501ec867dc3fe3e27701b

  • SHA256

    640944ca943d2816068e04f6c170f64a56c18af92ea63e69a324abbe18e5de1c

  • SHA512

    0e28621291a48b19e31acc00bd4818e8293a92e7fd5685e67a2dae3e9176d1c9eddaa44e94617f932481f721ac5f5fb4957beb7e7bcf99a7399c46cb906a1d2f

  • SSDEEP

    6144:/KKj2/5sVR5wTZj15L+XW7T5vrDbiySqxQgb/g368Ymk/13lu:paQ5S91N+XW7TF3biySqxg3jk/dQ

  Score

  10^/10

  cybergatelatentbotneue freundepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2