Extracted

Extracted

• • Target

    53210d76b9577cef53d4546b4b54f944_JaffaCakes118

  • Size

    404KB

  • MD5

    53210d76b9577cef53d4546b4b54f944

  • SHA1

    b15801b994b0d7d8b8f060996298f7be19dfca58

  • SHA256

    2e6a3a919be9d48fdebfb08b020e90845f12dfe0155c56270ee81a0f3e8b66cc

  • SHA512

    c273a71cf0222037ff4eecf79bd3211b6bbf97456bb98d2f0c25b00eb823e1135795baf7f5137710e1982b8178b813b67e56244ba12e074d9196a4e3cca6b53f

  • SSDEEP

    12288:KiSC/HR5+iLb0Be5Wqp7ssBlRwWW6o6daX:siJJ7zBlRwSo6dg

  Score

  10^/10

  cybergatelatentbotremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2