Extracted

Extracted

• • Target

    9f7a7cb64c4b11e8a315c983ed86e0c7_JaffaCakes118

  • Size

    457KB

  • MD5

    9f7a7cb64c4b11e8a315c983ed86e0c7

  • SHA1

    9956bca7bb55674910ce2129562159fe9dbc8553

  • SHA256

    cdcd89d04103b471be3772f8fa8f3bbf49c788c3541f236417d8ddefcb771c67

  • SHA512

    c2f1ab1aab0fa1b2acb487dbbec28b6b61ba584f782116f417905a8f3f224f8b1622b0fd11c78dcf0b3ea1153f0c4f052bb3aa445899f0392b82735674176c04

  • SSDEEP

    6144:/+p9442xwB+fwg+kkcIcvJzoXXXPx2901boHGNc9wQQpAtsd6Ijum9el:/w9pAakkAvJWXPyRHxuQQpAWrjL9el

  Score

  10^/10

  cybergatelatentbotcssdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2