Extracted

Extracted

• • Target

    b0c3d26466f5a5bf2216402cdf0f7c85_JaffaCakes118

  • Size

    422KB

  • MD5

    b0c3d26466f5a5bf2216402cdf0f7c85

  • SHA1

    c01d4b6bb07b95a0a63b7af1e45af213b3ac3f5b

  • SHA256

    23903bdf6ee51de7d00487c3525e3c3d6ae8a8dca3b124717c4b535e541cc6b0

  • SHA512

    ccef9de8a68d8e09eda82003ff39fee4a02275e1298784351cc4809714c873d218a908871c56246565df5e39d7866edc71f92c412c9662d9eafc7a53a24f8f2c

  • SSDEEP

    6144:dsyONZF2GMupeRw22tXjJg4oeMosnqD1ijXdwqFa3VM3OZCy38Iffy6ac48Ks:zONZ5in2/otaitwxsOPZfa6H5v

  Score

  10^/10

  cybergatelatentbotprueba004discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2