Extracted

Extracted

• • Target

    e463563cdcb68e750853dd332bae0441_JaffaCakes118

  • Size

    2.7MB

  • MD5

    e463563cdcb68e750853dd332bae0441

  • SHA1

    2e0411a2abfa1bee916990b63f98ab1c190742d7

  • SHA256

    13f9d0d409f91c4f99b8345606e2bb9c551dcf758d2bfd7d7e626981ae2d735c

  • SHA512

    be0741e95ebae479800d5fe27fe31e42bbc6c8ff3d9dfe832ba8c443bb9be0a17ee34c4b52f7e24b4bfe1a1c86313ca34987d02b5a4254fe996d3c4abd01f214

  • SSDEEP

    49152:5vtAMrz2W4JADtoUk+pw8CY3mxxtyMHDBKw7bOgjIgJXZzBoXrNKEIGs0/wRoU:HLm3JAxoUk+p4xPrjbDjI85BChRR6oU

  Score

  10^/10

  cybergatelatentbotvítimadiscoveryevasionpersistencestealerthemidatrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2