Extracted

Extracted

• • Target

    46d68527c3096161fbe2b3c0ea301b7d_JaffaCakes118

  • Size

    413KB

  • MD5

    46d68527c3096161fbe2b3c0ea301b7d

  • SHA1

    4d2016c369644a8e7bec07dd6243f03723c6db5f

  • SHA256

    ad4668d9ef55061c81576e09c0ccca2b5abf9c29a77fe095b228048e594cd378

  • SHA512

    0238ac039e1107f6d28b022fb248619fb38325f563c2b3e675cbac6daf3f4cd495525cebb5ec1c8233d09a960303a1568c10243708ffde05fd176146a6c1d038

  • SSDEEP

    6144:AJL9BRe4sL9BpOEzDteOeKzd/A8UzhwXdaGNQcnp9zF/XBCcJrrr743Yw:AFzmzpO81vI8UQYncjpJCcRrAow

  Score

  10^/10

  cybergatelatentbotserverpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2