Extracted

Extracted

• • Target

    4e7f65cb8211ecfb3047e9ec6d023fda_JaffaCakes118

  • Size

    644KB

  • MD5

    4e7f65cb8211ecfb3047e9ec6d023fda

  • SHA1

    eff9797c3d42a3ceaad7fd554f22355109ed448c

  • SHA256

    1e202cbfa1c0df4ec07f8f265e567a2eb2ecf5ed280fb4fb1bd8a85724051477

  • SHA512

    0fe098cbf18f9ebd7eacb36579171d7f8d2572556799493e4b8072ebcd4f70a9de82f125ac8b5d902428a66d354d2de9b8e8bdf6accd457521bdbc28d3b510b2

  • SSDEEP

    12288:Qzu+Uzm1p8AjaBuhqqlWU979dTKUoId4t9W:GUCmQQY79d+r

  Score

  10^/10

  cybergatelatentbotremotapersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2