Extracted

Extracted

• • Target

    d24f7d4a48d3eb384710e59ad7133c45_JaffaCakes118

  • Size

    468KB

  • MD5

    d24f7d4a48d3eb384710e59ad7133c45

  • SHA1

    91a458ac7fde411181b720eebe51801b2581cade

  • SHA256

    bf26bb7880f5f294bd415b7f44f327b47b614cf37f869f298d2406cccd2abf97

  • SHA512

    233732cfeb54a95641e1d7d275ea64bc9463cb48794960e47d53d29ab72e38807875a644cc2a508ded46d4ad75e7d0225abd1dd891a87a94148d9093a381ab0a

  • SSDEEP

    6144:dcrSMwbfMjszEvI8XXLF0kFqoHRZQVaNZX5v3jzE+85:4SPf8QOIiCMjygBc+85

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2