Extracted

Extracted

• • Target

    JaffaCakes118_d328f3a5f09787f7e5ce436946afe8b0

  • Size

    324KB

  • MD5

    d328f3a5f09787f7e5ce436946afe8b0

  • SHA1

    60d35e04b86ee259eb4b2eb9d7d00f452943391f

  • SHA256

    11d974cbb620ba40566b061fc0a590d1652e0a60fdb3defc64521589430e2ba0

  • SHA512

    977df47ccfbb77fbe4c039204930221e85a4622cc28b3a01345cc9260a4ffa8a138156cd6ca1c18266473b68aae157641edc4394ad9c45f58f04ffb81a81c605

  • SSDEEP

    6144:ZScrLx4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijd:Ecmy78QSVnNyhsFMCeSjd

  Score

  10^/10

  cybergatelatentbotvicdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2