Extracted

Extracted

• • Target

    9fd187f3932c81656d255e528cbe41ca_JaffaCakes118

  • Size

    416KB

  • MD5

    9fd187f3932c81656d255e528cbe41ca

  • SHA1

    5eba11866de746e2e60dd803c22722ff70905df7

  • SHA256

    658b5002529a1dfafda5fac37d00d79f9d1dadd8b6f206e68d8ddc8de7a39779

  • SHA512

    06270ef28791626894584a67a3c44f2baf8f42371028e39d15807dd7402be3dd48ca5c57ec6825502a3312120546d6d3d1eea8b7a8d33d17d00ff8e58ce826a5

  • SSDEEP

    6144:hI08XA9TqSxddp/vz15HbG9zuoC3hC5OFLPnm1KNJ9WXsi9RAVb3rolVdfhV:+0CAvdddx5Hy9zuvRBLPm1KUtRCifhV

  Score

  10^/10

  cybergatelatentbotjava drive bydiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2