Extracted

• • Target

    JaffaCakes118_78a136eb3ff00f722e0229e057aff094

  • Size

    918KB

  • MD5

    78a136eb3ff00f722e0229e057aff094

  • SHA1

    a0934cf9297d3026b468f9f01ee1a20f0ebd1a52

  • SHA256

    6e4555abff217bc3006086944e6d69de2fb7a51cd8fd95fe03a25d2414a60c2a

  • SHA512

    14eddd57da58dbc6b3863a9b0d1eb803b53450c521a2d33648dc03064a8fae6e0c88f3447e6dee9567e3cf221a9f4bc2c130684dea604118df29314458e1be82

  • SSDEEP

    24576:1aHMv6Corjqny/QLHZDBbo3j+rWTeah2SukRv:11vqjd/QL5Dq3j+STnAkJ

  Score

  10^/10

  cybergateonlinediscoverystealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2