Extracted

Extracted

• • Target

    3b38a9bf7ae5f16706719be43fff89e1_JaffaCakes118

  • Size

    771KB

  • MD5

    3b38a9bf7ae5f16706719be43fff89e1

  • SHA1

    4fd6eb69d4369adf73326568d8471a8ab972c116

  • SHA256

    cee9f69d6b7fb2492a46f42a29bba93a9960b20bc85c79fb08836222f3b2e133

  • SHA512

    c17b7b634b4b89c2f9087e59c24ceebcd75e4a586721ad723f8f799baf6a413216ebd72a8d13e59ccf2fefb2dbbfe7bb7b63e97e8b47d2754218d670ab6bd537

  • SSDEEP

    12288:zolLpWFvZtnerkPT/hwAKM3rkEeopoA1O52z:zosvZtnNiATkERy2z

  Score

  10^/10

  cybergatelatentbotcybergatepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2