Extracted

Extracted

• • Target

    JaffaCakes118_68a0f4f78f7a62a8a400ab72359e95af

  • Size

    687KB

  • MD5

    68a0f4f78f7a62a8a400ab72359e95af

  • SHA1

    4c8d8ef15b39730cd5361929f70cde12041145ea

  • SHA256

    cc8c25a32313c4df8f070c60c387d4796ab0e1b09fcdfedffb19ecf14034445b

  • SHA512

    1d45d8aebce3794e40c3747f099d5c6e9e8dc4cba7e130aecf9aae0efa2c1bd623f8b237d4a0527a277997622708c59591f8980a8041d74c22cd3d649e413d99

  • SSDEEP

    12288:3s9G69r3chyWrK+Yrsq/Tz06WSnjj/zJ+6NBSFnOqxWhf24Zmwej:3s1Mh3yH06Zn/zJ+6Ggff4fj

  Score

  10^/10

  cybergatelatentbotremotediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2