Extracted

Extracted

• • Target

    JaffaCakes118_1e143a940e6d92057b94e9c3245aadc8

  • Size

    481KB

  • MD5

    1e143a940e6d92057b94e9c3245aadc8

  • SHA1

    f8e66be1971247e5eabab818d5a2bc7dd6122a17

  • SHA256

    4e0fe4fcd1f1b443de8118b14329250a2a5494fd30aa60817cfaaa464cb44aaa

  • SHA512

    1ac7df994e1b28c35c0ad90583c3057fc5623be979bf7ba90b97f9cf7b761170ad5920442f201324a843f400766da0766bd5320020fdda16770a1a3ae36089a0

  • SSDEEP

    12288:c+jkkdatIWurblwctxkVGvi+yKNsAzI0LGV:c0kkdaOnbfkVGvj1NsA8

  Score

  10^/10

  cybergatelatentbotvictimadiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2