Extracted

Extracted

• • Target

    4ac85d62e85ae2ea357c4f7e5b30d3e6_JaffaCakes118

  • Size

    833KB

  • MD5

    4ac85d62e85ae2ea357c4f7e5b30d3e6

  • SHA1

    9b30bc63ea53b703fb6423269057fc3bf7ff24a2

  • SHA256

    c6ade17dd10c402b824f82595f6f0a46bb5177e4669d55cd26f5b518a8e3ece2

  • SHA512

    85de0008fa41811ad9de1800acf71344282cf95106aa5434b62778839d86ede5121f226b6a853940e38f6e66c85e406f10d0d4fa98026bcbe35bd0cf103a11d8

  • SSDEEP

    24576:UGUx5xwRQ5OIjcLcjNkOYCEoF949WFtN1j:Ul

  Score

  10^/10

  cybergatelatentbotslaafjepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2