Extracted

Extracted

• • Target

    0a835aaadb9f68d5eeee90c11b200f0c_JaffaCakes118

  • Size

    4.9MB

  • MD5

    0a835aaadb9f68d5eeee90c11b200f0c

  • SHA1

    20a19c6b7116ada0f7b357ebdfc89f263e7e896f

  • SHA256

    3e87add7e25873a1817d34c80d18fd0146757885800dd6b3ed1cfb92b94d6e65

  • SHA512

    377261bfd4c528c813fc1a39f01f4ace4a1715d864f47ce9118d04c48fd7217b218583ec451418e1118836fe52eaa485f40d224676adc3d343a5e9a1fbb5bc82

  • SSDEEP

    49152:Saezzkd+DFLqD49T8abZoVbS+icNBejkjDk4b:

  Score

  10^/10

  cybergatelatentbotcyberdiscoverypersistenceprivilege_escalationstealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2