Extracted

Extracted

• • Target

    5893a632e206d3c23c686c2e10b88d47_JaffaCakes118

  • Size

    286KB

  • MD5

    5893a632e206d3c23c686c2e10b88d47

  • SHA1

    07636bc6fb3e3b25798fc01def01ee244f6eb98e

  • SHA256

    631bd1e0058c9ae1c70cd92e8eefc76eea3ed141c059c18ea5c9795a407174c5

  • SHA512

    5116074247f6ec298725f4aae8919aba6d1fda31b0002e95e122a58a1ac415d4168670d5be870cf56048e069a55044cc4cd12ffea48b59e2c72485d08d4a71ce

  • SSDEEP

    6144:qy+phyIGTwlTLfkixFUQKf3D7TnBAZ5qhbx:H+pEp0lYixsfvDBAzK9

  Score

  10^/10

  cybergatelatentbotremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2