Extracted

Extracted

• • Target
    dcb8c04d15d70e4989c118e3a3ffd208_JaffaCakes118
  • Size 2.6MB
  • SHA256 38b1620c31b50b6aa01e5de1164a9509ab63bf47ce217202dcb70474d608e2e9
  • MD5 dcb8c04d15d70e4989c118e3a3ffd208
  • SHA1 4544b72b8aa614bf8cf0c35d7a4174dc478c6b5f
  • SHA512 79c49a9112974b84a98d934bbe5cca55dd85e7b9bab62080cb2059116e1afe52e071a444b791018eb716aa913ee422f7e575a5be91a50a2f544ae39900090954
  • SSDEEP 49152:WvfJVlLGvSUsVQJocw85IXxir8Dg3LE5XwLLCV1z:Wvxf6SbVQ0Q8DKJKP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cybergatelatentbotfacebookdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2