Extracted

Extracted

• • Target

    c02e77d9700673deeb7e8a62ceac8335_JaffaCakes118

  • Size

    1.0MB

  • MD5

    c02e77d9700673deeb7e8a62ceac8335

  • SHA1

    80f8aef98c8acca351ea2029c99bf5dd6ea4cdec

  • SHA256

    924b1443c083e2b6db674615048d8d8cac05ca75be6227ecad2c3af6b51597f4

  • SHA512

    80197b9bb00d13577a58f0e0c9d46cd5a3464918e3f7db0d781808dea5f072a710c4b86564083330b53dcb819ab5b386a87aeba812ca2ef8775cf5a528124b55

  • SSDEEP

    24576:LKiR4Z12hgdItzcRgKScI8R+pzBjp2NSjnVnj8oJ+rd0OP:Q32hPwef8UjpXnoou

  Score

  10^/10

  cybergatelatentbotvictimdiscoverypersistencestealertrojan

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2