Extracted

Extracted

• • Target
    c9421e77df17cdd6ebd637aaa32b2e4f_JaffaCakes118
  • Size 404KB
  • SHA256 6d58a420dede321f638ac8b4c182c2e2df83585b7658a15d6f5d6c4f2314f78a
  • MD5 c9421e77df17cdd6ebd637aaa32b2e4f
  • SHA1 44360f7937f50e87f3efaf22e3f0abbeb78d85cf
  • SHA512 f627f74a794efd90aae9098a8a1cd49bd6fdfd74a3092bc697a32232a01e4fe66d006902a3cb1c3a2e396855f75d35750b724e684a1dbc7e2ee39cbd1553fbab
  • SSDEEP 6144:HDkJP9YgVZsKxNCTxAZMKoYTk8b4Y97Oi2B8thHtEriULonNF0srj8Gyu:HgJ2yZs4c+qGThb4svthNcvUnNB8f
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cybergatelatentbotmediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2