Extracted

Extracted

• • Target

    4f656bf81d0e03b9457e3bab82d574ab_JaffaCakes118

  • Size

    356KB

  • MD5

    4f656bf81d0e03b9457e3bab82d574ab

  • SHA1

    c8b32f87c71ddf3258aa683cac130d047eeabf94

  • SHA256

    dafa240086ee8bc59a89e97942bffc2c806f292e24ef120726676b604ebbf552

  • SHA512

    6a59705b47743db73dcd5d98453e59587971dc48fa478c87f1f7981dd936eae74618020a2bdd56af952486af38a0414125dfcb429adc2b1f5de602d7480bb069

  • SSDEEP

    6144:bay5Zkz5LC6+jbOW9TqxkT2N6K3+W+sZD2SudK8wn1SFgrp3nwA:bbZ827bOWYWT2Nx+W+WfSK8+WA

  Score

  10^/10

  cybergatelatentbotprogramstotalpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2