Extracted

• • Target

    JaffaCakes118_950498c4c0dc51e344ad9113b2108ffe

  • Size

    376KB

  • MD5

    950498c4c0dc51e344ad9113b2108ffe

  • SHA1

    ec93d43fa5667c5acffb2cf3e3f849d131ebba5c

  • SHA256

    1790f49ebff29f55180c7069410e049c0cd91cbaedf5ff68baa96b3d35fea7c2

  • SHA512

    cd05aa112e9cb9d530bcf3ca90bf5c074ee7a716b2c026269445b17ca11c1b69192b142899cf9cc5926a19260f855c4d0f160582720465688298b0121187086a

  • SSDEEP

    6144:XSB1Ed0h/CB5OVhc9wlJTXIpDQKbtbPgRTbcjbfRep317twcVXr6Sw7+eeTKmjpN:X81Ed0hYcVhrJbIpQmtbPgRfcjj430C/

  Score

  10^/10

  cybergatelatentbotdiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2