Extracted

Extracted

• • Target
    8f05c8c7109f3454de96cdfa641ede8c_JaffaCakes118
  • Size 298KB
  • SHA256 ebb0f32491fc60f8cefd8b7d08dff24b4b86c6daafc7e47e38fdb929635b17f9
  • MD5 8f05c8c7109f3454de96cdfa641ede8c
  • SHA1 d781dfbd0b821a855d0dec6bf60f646064cf82ac
  • SHA512 3beed75c339933de027b3959843ca0b6ede5231619e432fe882a05667628562672edf048fd74f0a0df616f511192413f07054e1337da0cd219d71a753f0fda18
  • SSDEEP 6144:Se0406qK6zL9+FjOfC/6ovsN1/YO53iDdsXDtmgQGDkARO:SeVgK6X9+Fyss3gOADaXRm0DZRO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2