Extracted

Extracted

• • Target

    a5c9543b68e0b4ad73e22df10005eeed_JaffaCakes118

  • Size

    351KB

  • MD5

    a5c9543b68e0b4ad73e22df10005eeed

  • SHA1

    db61cbb2eac07e5051d3ea4a484c3e8e1e451f6f

  • SHA256

    ce5f467d026b6f3109156f3e3e01655d7a19466a6f31aef4740dbd37e51fee02

  • SHA512

    5c1ba8ae3625e491169d40083e05b2546ce260e64ffa0d13a7afd73cc362dd4b97910f8a0032c30b937b8482bdcc8676e1751788fbe32f6c9310fa661ac35973

  • SSDEEP

    6144:lWP9Jfphi+XcwKcErWMCfBC9kwzr45OAvUhFeGyP2peze5TVTjf:lWP9JBYcUWMSBCaoqchIXPqBdFjf

  Score

  10^/10

  cybergatelatentbotvictimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2