Extracted

Extracted

• • Target

    fc27512a0c8b88db74e7663fd10e163a_JaffaCakes118

  • Size

    364KB

  • MD5

    fc27512a0c8b88db74e7663fd10e163a

  • SHA1

    97306be4ac5b5dfc0462b1949db3fd177fa6ddbf

  • SHA256

    9bc6a9a61a6df76ae5dc76bcc44087824249bf01bc6b515ebcfab7e9f9ed6ce1

  • SHA512

    9cb0b5af5ecf4f54089af36381448c855ae40319d0e5a14514011ce0b1323418c2d62b29fb5c24dc3f77c52c426e394911a83cb713d6203770887d648d24defc

  • SSDEEP

    6144:ThNtPtd63dAv1T66O8QIUiweONU0ohsHIBxrnLOT0I6TLlet83iaJJ/G3q:TDtX63yd66OOUi/ONU0ohsoB180f9eW7

  Score

  10^/10

  cybergatelatentbotnavarrodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2