Extracted

• • Target

    c72d1b3fb02794ae76980424a0774728_JaffaCakes118

  • Size

    1.6MB

  • MD5

    c72d1b3fb02794ae76980424a0774728

  • SHA1

    b82c7c2c3695ce43fff682cf19081efc6321857b

  • SHA256

    7119c1c918f304bc0c2a63bb13c72a037540f58de0b0f2fa050f7f508552e328

  • SHA512

    53e75a4a7e641ca0e48e9aaec343501dace4d9d31dd75ad87d1ef2d77cabf2ba2d2e93acb4356350419de4691e74a76cd22f56c7da4a8026ba87aa7fa0767f03

  • SSDEEP

    24576:Fvpptbqd/PIWBwr6b6beNfo4b5MRXIRkwZfGKVQ4h6KtTkcWkTI3:Fvxb+iiNw8MRXRKtw4TI3

  Score

  10^/10

  cybergatelatentbotdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2