Extracted

Extracted

• • Target

    10034e5acbf9c7d5e98eabd440dfc28e_JaffaCakes118

  • Size

    955KB

  • MD5

    10034e5acbf9c7d5e98eabd440dfc28e

  • SHA1

    b2575e522f4a47123980141580b705e4b544b4b3

  • SHA256

    cf10bdbd4acbe1630a0f7360680768c1d5e2af305eefc0ac8852f3b7610bfe52

  • SHA512

    12b3fe73a1ca5d4badf5c9727f7d0745cc3ef7a6a1c6ec87d6fa56ff3e8c177abf24b8670675d4db9ff9ec155229597e8f976439a6b748edf74771391ddd3839

  • SSDEEP

    24576:vl8QfAgftcJ+ux0xGGcHjYEwIafxobjevj6lC8cihPe+iGL7M12xpzRcI4f:98QfAgftcJ+ux0xGGcHjYEwIafxobje/

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2