Extracted

Extracted

• • Target

    bdeb6647bcbf8f94010a9b99ade29692_JaffaCakes118

  • Size

    668KB

  • MD5

    bdeb6647bcbf8f94010a9b99ade29692

  • SHA1

    07063a7b06c36600fa034a33099c0807adb40a5b

  • SHA256

    33c50032f0badccb6a7ed50ba9040a656fc549dfdd50d8a8c26374fac8f575eb

  • SHA512

    527d78a8cc8792f343ee1a64fa9bb2c3b910fef7135f5074296286ba8f0c906d348caa8be6f92f18eec352cabd9b380d8e51ce32f9733d24b4a1e3813a27f135

  • SSDEEP

    12288:ejZ2qVMR2Cow00kBwJyzcEwfQC65GhFQ2FsDaCQFfV/fg7F/wIv21Yps8iEo8Wno:W7TpBHYGK/V3iYRC9Wq

  Score

  10^/10

  cybergatelatentbotcyberdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2