Extracted

Extracted

• • Target

    70d25230e32a7884bc28ba0d9728523d_JaffaCakes118

  • Size

    311KB

  • MD5

    70d25230e32a7884bc28ba0d9728523d

  • SHA1

    16e9ac7700a3889a92dcb5f59efc26cf82c01987

  • SHA256

    00adc182c6edd716feac3f1337515cfb7be7e4c88d536285477fac9d7029e685

  • SHA512

    678a50cb0a8857c5644edd19e3e8706d73151ee26986cd7cca1884083390ab380b9d84fc2d30388b0ba8d38b9618fdea70f217dd01614bcca53ce41c8d2b2a0a

  • SSDEEP

    6144:fJuI9CZI6RI4X0RHc2f7gcQ93v5e2+8EM/2eLHsREB4zCtMuIdLBPtdzWIsbEwz:EIHSI4G82f7e3Y62WMXzaRIhfpWFbEK

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2