Extracted

Extracted

• • Target

    a1a296b76be90dd04c3c671b670145a5_JaffaCakes118

  • Size

    3.4MB

  • MD5

    a1a296b76be90dd04c3c671b670145a5

  • SHA1

    92634cc255631c557dd8ac3b53f9d33de931a5a2

  • SHA256

    c977ad9044bb20f176f8ef1c1f0c311092be604fc985e3b579ad3c965ba4b76f

  • SHA512

    04cd1cc96ab1dbbfea0b9bf0d7b6d43b517b02b600017209af4333e0ae2e5aeafc4d200738b4691dd731918df8d80fbfd660a6506bf2a5c358d00506dd8b2a0e

  • SSDEEP

    49152:mcD5EcpDgsiwEY21Xn0uyoW3L2HOUARbMvl4ePASbANkrNDkyPgTrPvJxk7W+JiU:v20Q3ZQKNARgvllANkrNvPar5aaPc

  Score

  10^/10

  cybergatelatentbotremotediscoverystealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2