Extracted

Extracted

• • Target

    fd30de730c7025df2ac7db0728883da7_JaffaCakes118

  • Size

    784KB

  • MD5

    fd30de730c7025df2ac7db0728883da7

  • SHA1

    11ed539a5c6799fc65e94dfe6678dd513a14ab68

  • SHA256

    c41603b0ec544d4e12441e03903ede3f8b22eeee632dfb43ecd84be5f83bd1c0

  • SHA512

    7ac873a5fafd34bd06f6db5838e6f318b432c5751a3501624cef7eb0650c0c17e17771f0e9ddb52f6d9d6a23a69b773cf53d4f8fd142e2524f3603284a5fa1c3

  • SSDEEP

    12288:jmhY7clTLG7qMM0S0/sKhGuEZIjTAl971M+f0F9FeiDz99sJDOmTkE/AwP7Injqm:6u7qkQWYJuFcDzAd

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2