Extracted

Extracted

• • Target

    ad4fe0fcec8c6f274cab8e6a4e3b9004_JaffaCakes118

  • Size

    354KB

  • MD5

    ad4fe0fcec8c6f274cab8e6a4e3b9004

  • SHA1

    097f4f77047fb8b49a2d1cd479db0ef3c329f1de

  • SHA256

    4e4652c59174b0c98ef2817e0bf985f1a5a936460ee2482a5652702c8845d9e9

  • SHA512

    a4c183722c750d8b5ef915e02e160644c59132fd5974f405ea11a693ed7454ecb7b44891b0b7cd54e75fc3f8ffdecf730d3de11042c32c54fe31ba522a2e667d

  • SSDEEP

    6144:gayVOR0es5BCMhgnwbRkeZDXwKvsuIIrPRZbzMN3JOeNz89kmsqEwMzF2iltcN/M:gayVOR0es5BCMhgnwbRkeZDX/sUPe8+J

  Score

  10^/10

  cybergatelatentbotvítimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2