Extracted

Extracted

• • Target

    632c5b173f67deed6dba88f66e58bd2d_JaffaCakes118

  • Size

    428KB

  • MD5

    632c5b173f67deed6dba88f66e58bd2d

  • SHA1

    249dc9a6e5907a8916d4be51421a2baec731e3ed

  • SHA256

    7546ba2d00688db89726e734efba35180198a9a1dd3c9607504bb19008823ad1

  • SHA512

    a5642ca93cda3fb39c94a5d3123be2f986048db02b4eeab3e6275147cb250e73ee8283d6c52c839341170edb4a6b9171335f841c264bc07304c97066c3c23e51

  • SSDEEP

    6144:lSPbEtsS/454x4ihdBCkWYxuukP1pjSKSNVkq/MVJbExyjkyLC03r2BS:8z2TBd47GLRMTbyynLD72BS

  Score

  10^/10

  cybergatelatentbotcyberpersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2