Extracted

Extracted

• • Target

    JaffaCakes118_6f178714e36cb29185aad0b2432b7855

  • Size

    287KB

  • MD5

    6f178714e36cb29185aad0b2432b7855

  • SHA1

    25a1eb36efc78f080e1f27147e529bd9a6c18cff

  • SHA256

    1c3e728c18c4d0fd11e2db692d113515d428ee5ea5e5b1ef6f116656895e7c2d

  • SHA512

    b1abb233f1217dda772597f6e82931496b9495b34e902b5d343a9d211b6b380b0710bf68820aa0fa91872e56ad851af9a51b1a8902017746e7f5b069fc4f532f

  • SSDEEP

    6144:+mcD66RRjX5JGmrpQsK3RD2u270jupCJsCxC/:7cD663mZ2zkPaCxU

  Score

  10^/10

  cybergatelatentbotphotodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2