Extracted

Extracted

• • Target

    736b9fd57799e513416c2d8091062a39_JaffaCakes118

  • Size

    397KB

  • MD5

    736b9fd57799e513416c2d8091062a39

  • SHA1

    73ff65600a7838935217ff41d9d25aabaaf6e29d

  • SHA256

    9b8c7daae6499566fc186efc093e7e37af3518d36235257fd3ebd8be84d9b659

  • SHA512

    5083424d7b8b4c8d1d45be84dec846445650e83155021ae89cdf3a5b1c82401d4d3007ad3f94ec9ed86e9cca26d3d64dcf651e960fbb2ae15012e4adf4fe3997

  • SSDEEP

    6144:7k4qm/KaC6T9bN3vy8i7qtqydqBVgBXUpnuZXvbpsqGFlyUTm2xf:A9feTBJvEhse5pUb2fDGOf

  Score

  10^/10

  cybergatelatentbotvítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2