Extracted

Extracted

• • Target

    68bf326b4584083faf0b1ace328097e7_JaffaCakes118

  • Size

    360KB

  • MD5

    68bf326b4584083faf0b1ace328097e7

  • SHA1

    6e10b42999788bb7b9867ad21ba6ad92a0e5fa4f

  • SHA256

    88153a883b7633b1fc0208fe8cffdb3cd9e87f1f4aac5e1d74949524a91155d4

  • SHA512

    76dfc07c4be68006dadb22da8120d80fa8d25bd2f38542aefa087c7ad53fe957d173d34693d1473b4d1d014e9c9f590e1272450a383cdfe7fa0c95ba5ce6bea0

  • SSDEEP

    6144:uEVIvEG4XawisEXgTy7zzvr6GayPElEcJmpuHLhgfENTY8V8Bh0PYY9H4I:uE+MBXawR4HsysufuHdgsyZhE9H4I

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2