Extracted

Extracted

• • Target

    dcb8c04d15d70e4989c118e3a3ffd208_JaffaCakes118

  • Size

    2.6MB

  • MD5

    dcb8c04d15d70e4989c118e3a3ffd208

  • SHA1

    4544b72b8aa614bf8cf0c35d7a4174dc478c6b5f

  • SHA256

    38b1620c31b50b6aa01e5de1164a9509ab63bf47ce217202dcb70474d608e2e9

  • SHA512

    79c49a9112974b84a98d934bbe5cca55dd85e7b9bab62080cb2059116e1afe52e071a444b791018eb716aa913ee422f7e575a5be91a50a2f544ae39900090954

  • SSDEEP

    49152:WvfJVlLGvSUsVQJocw85IXxir8Dg3LE5XwLLCV1z:Wvxf6SbVQ0Q8DKJKP

  Score

  10^/10

  cybergatelatentbotfacebookdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2