Extracted

Extracted

• • Target

    JaffaCakes118_b03b9cc340dd1b5d3b28787286b0a7e7

  • Size

    482KB

  • MD5

    b03b9cc340dd1b5d3b28787286b0a7e7

  • SHA1

    c36ea9a9b5b46ea60a1be417e40712cdaed14d42

  • SHA256

    245f029e966022ac581ea5ea75d13620f9359c98fac08895f4fe39729a976721

  • SHA512

    3ce79bc6f7d6bf025131fc709e6161c69859be9a5997f9be78d79c52d1cdd5ba6587348310e35079970b224fc6420134590f81432f83a8f47b36cb6ce75efe9f

  • SSDEEP

    12288:yXV5jmtiq7+EfZXQHmBZAnEl+xB5pH3CKhLRjUo1KLj:I53QFfZgtEs5pSUdUo1Kv

  Score

  10^/10

  cybergatelatentbotinfectadodiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1