Extracted

Extracted

• • Target

    97c2579d4d64d3250664b1e3842a1f92_JaffaCakes118

  • Size

    547KB

  • MD5

    97c2579d4d64d3250664b1e3842a1f92

  • SHA1

    bf62d57bcded52e3190c210fd034f5dae383e58c

  • SHA256

    e074320678c5242d5b7ecbd96015ad50a41a22b201966bdfdba36061ee06203e

  • SHA512

    abd03dd8154ec6b698c9729dd1aeaab36a96982b572c44d518b04f7e08a635641137495e638c4468c72cc6a359c9389a3391b60810a1e894c06923014ea7b21f

  • SSDEEP

    12288:ZkSccZ/bEw+28hFxjQPlrBCk5M0toZIV5xT8uqFzIMgypD9hyAfD0te:lcgbAjQPfCkUZULtqyw0Q

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2