Extracted

Extracted

• • Target

    c53a28b1c0a6b2dbfc3eb6c5c9fc3541_JaffaCakes118

  • Size

    408KB

  • MD5

    c53a28b1c0a6b2dbfc3eb6c5c9fc3541

  • SHA1

    fdef5d28fac1fafc3ac8b9b770e06f63cffbe722

  • SHA256

    1f2cf5385bf2fa4257c54a73b1e8302cc630be6825dd19a74ce6d7ed96ed7acf

  • SHA512

    dfa918fc2c7c2cc257e8c616d29d16120cf09238c81c8bb2b92304276c47eea0f7e5bc70f92fb0591028e94ad29f5ad85c96e5bf13c2f0b39a6bdceffccefdd9

  • SSDEEP

    6144:ZJGPoT1wiQtiiIEw6d2LB2kVXzDBsqT5H+qVqoLSDWewMvQ6Y4DTP:3Gi1atiqczVXxsi5H+qVpuWewM64

  Score

  10^/10

  cybergatelatentbotlobabootkitdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2