Extracted

Extracted

• • Target

    47cc02acd1240aca5d805c232c485c1f_JaffaCakes118

  • Size

    305KB

  • MD5

    47cc02acd1240aca5d805c232c485c1f

  • SHA1

    369c48f2a64575ca84456aec067efc632fe23b22

  • SHA256

    2f3882fca095e9fa549fb599ae0975fc373899f2fe5a34e7452f237ee546661c

  • SHA512

    503b4348ad10d1459e15b904fa193fbbee933e953d3ac0f286f1f92aefeb6c546ba2e7789a9e8a48db3f73493c4cc0ecc30821cfc16b9107164fb37d2739ebd0

  • SSDEEP

    6144:QWBYm9hYt430JiMQKXZrohdBCkWYxuukP1pjSKSNVkq/MVJb:naKfKpUTBd47GLRMTb

  Score

  10^/10

  cybergatelatentbotqwerty123persistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2