Extracted

Extracted

• • Target

    d9eaf987ee3a0f3bac692e9e21b6b89c_JaffaCakes118

  • Size

    672KB

  • MD5

    d9eaf987ee3a0f3bac692e9e21b6b89c

  • SHA1

    aac15b5ec0ab1913fc5b6f5397518573c4af17fd

  • SHA256

    4876014b50fbd615ef3b9bbeeee26f1e8b451be39fc7aa553eaea6068847fb45

  • SHA512

    e7776c20cc5bfaa5334a667f972b3addfbd8b1772e9aef33768f53e98c5ad3f44965dc8c56c00ac96f99a430bb0866dd4c13849bae9ff2d5951ae59e3e8d83d5

  • SSDEEP

    12288:b4EKFlzysA9dVcLAdByeH35XQOu64RUZ9TpZCpMhV7q0KvCXMzTT:4/aVu2pHpA5YZFGC8z

  Score

  10^/10

  cybergatelatentbotgla1802discoverystealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2