Extracted

Extracted

• • Target

    dae61dd2c1b272c07bfc7f7d4aea08b6_JaffaCakes118

  • Size

    690KB

  • MD5

    dae61dd2c1b272c07bfc7f7d4aea08b6

  • SHA1

    b668d2c8ef26ff7f67a9d267ce930a109bb69a16

  • SHA256

    96b52d9463db646008561437884e7f3ea8c847f935c5f7e27cb229871c204c90

  • SHA512

    dd35219bd811f6c357985f6e176e87881a9a219ea0bdde1a15a9e7e7e1fbdcc9484d6f23613cf983eb83c235ce0a6f619a8d7b26bfeb6e57f39e6f480164c47c

  • SSDEEP

    12288:KfBMPgdGOE74R74jAiU+fCcgFPgmeCd2t3a9hh4S2QHpQ6lUro1SBv:+CWM72SrzCcgfeO2tq9PXH2rH

  Score

  10^/10

  cybergatelatentbotîàîìììdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2