Extracted

Extracted

• • Target

    8f593b9d8344181b9327d043d7bc73a1_JaffaCakes118

  • Size

    546KB

  • MD5

    8f593b9d8344181b9327d043d7bc73a1

  • SHA1

    49e89e520a9cb215803660a049f6beb700f7006f

  • SHA256

    e18dd495177397fd180cee62158bb9cdb63aaa23542701f94aca71634fb043e3

  • SHA512

    c896ce16d27a2c43448c001752c02121ac491003598866cc1b2562d934ce20a500be03a91726499f639c34f3691135637f11748d0c7c5f3aac93f231fb43bd2f

  • SSDEEP

    12288:x+xrVzppIMs7YFA0TpOINaEfd5/7Kcqa/BKZUhYRsk5088gXOjZE1z6zO/SZhlrR:ZEp1akd17t7sE4yNt

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2