Extracted

Extracted

• • Target
    JaffaCakes118_cb26de2d1e8c0c2eef582ea64cd127a2
  • Size 379KB
  • SHA256 e92448ad0990166897a65503c233d7ebfbd1a5c40af99223b6de7b9d2ac8546f
  • MD5 cb26de2d1e8c0c2eef582ea64cd127a2
  • SHA1 2437d42a5e8a216b9099064fd43fca69410e360a
  • SHA512 1e2639c85acdd875787b6b95ca40c573cedef45d8c53c48275bd4950a5839a6f71b721cf53a67b14bfb02efd9692ff8fb511c388a01dc4c0342c9ca763a8db57
  • SSDEEP 6144:Y0AO+49qaEPZvIEePateFQ2L+GQBf7rL3eM0q3cQy1QUjZFbGf/S:YK+NaWFjNbE+Gg73UecQSzjfA/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2