Extracted

Extracted

• • Target

    c0365d7223d9b82c3fe41f639376eb6a_JaffaCakes118

  • Size

    281KB

  • MD5

    c0365d7223d9b82c3fe41f639376eb6a

  • SHA1

    405a25b3c3803fb58ca63af905374812ddaac6ba

  • SHA256

    71cf6e73376020bd2585b4d6742daac29e6085b31864e04fbff7b7a0909dd300

  • SHA512

    b7dc5619fb25866d96d04919afeb87aeb1254acc198ae6eafb470e3b3f4d97da2db1416098e6590faef6c65ecdcbe5015e58d9b4e901d9e8a2d8c5bcf452f35c

  • SSDEEP

    6144:pS72GikLRA5kDXjcMreuARPaYSZ7ksZEp:0lScjcMyuOQksCp

  Score

  10^/10

  cybergatelatentboticrner11_2701discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2