Extracted

Extracted

• • Target

    69d9fdb803734743ad2af5f3c010e8f4_JaffaCakes118

  • Size

    472KB

  • MD5

    69d9fdb803734743ad2af5f3c010e8f4

  • SHA1

    1a202cb95afd0fc252848cd6acb5e0a4761b178e

  • SHA256

    d0a069e0d91056a8b778d7b496e9946f9ef248fc88cca82eb547ac13612819e0

  • SHA512

    6e7bb2d32d3494cf3149efd7f5446f5ab8ee55cc29d46966cf3f740c98d11d06a4ac4ead71e56cf472bbcab7f506596cebcd76c47f81bbf539d6867d3515afca

  • SSDEEP

    12288:botRDOI4svsai+SCsKHUiJKCg1OxEs1Eex6:bov94xarpv0iq8xtrw

  Score

  10^/10

  cybergatelatentbotçåìëßdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2