Extracted

Extracted

• • Target

    ba1dde2f0d0b6bca87f6fe173c158f49_JaffaCakes118

  • Size

    834KB

  • MD5

    ba1dde2f0d0b6bca87f6fe173c158f49

  • SHA1

    17e0e7ed54d0a55fd6b2312ccb74e5302b5913b6

  • SHA256

    cbc5f637a3fa9467f1c51a986ffc092a0266d7062a80c6f7bbb92ec931e6cb0f

  • SHA512

    6fbf1f9ce246a143426959b24dfb7a4b329f30722bde6d13e2b20d832453f3c1ad0c4612ebd819b26b5e07c66696924bde8f63fa2f9435ec59eb2c25e53c571e

  • SSDEEP

    24576:sILt+8mZJO5oWJR3qKo7uQ4gGo9te14sNIaeLhsdUS9g8:sYtj95oWJR3qKoK/dKJ4FGSdTy8

  Score

  10^/10

  cybergatelatentbotmuratdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2