Extracted

Extracted

• • Target

    c5b01eb4d1984f5dd7f8a3a04f215be5_JaffaCakes118

  • Size

    654KB

  • MD5

    c5b01eb4d1984f5dd7f8a3a04f215be5

  • SHA1

    429b42df3e2bd201f79e115dc3005fbeceea54a0

  • SHA256

    8fcba75c4c1c97a4dbb8956988da085ff9efeef78acdf6329eb68abacf0faf93

  • SHA512

    0f2549f4f44b03b93cf7eb2b18eb2a4a39398684350ade21e8bd624477445c660b5001517701682fa38c39eb248db42840b5bc727ee17cd6a98d54c408162bcf

  • SSDEEP

    12288:+HLUMuiv9RgfSjAzRtyL+AL7uXVWl3swgLzPJwB:8tAR++WaXMOnJo

  Score

  10^/10

  cybergatelatentbotqwerty123discoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2