Extracted

• • Target

    JaffaCakes118_68d66245d35fe901c3b1b8dffec8c797

  • Size

    1.1MB

  • MD5

    68d66245d35fe901c3b1b8dffec8c797

  • SHA1

    cca0ac53831ae0a73e9d63920bab02e8ccd3fc5c

  • SHA256

    64e81e29eced9bab30255aa7ecf8d7af2ba4114a1c0b526999f09e88df85d4cd

  • SHA512

    76bcba12a410f1083170413cfb73c8e19d165b6cbc4839a27c72a9176eae3ce49d5fa7739602a2aff3dd51905a4465dacc6a8cdfd7ecc2062329c99c738e5c8c

  • SSDEEP

    12288:35xmDMg291iAzhq3ar2/Ops9dmb/KlW8eZfPajMEsyIM9FiTe68jJMGar5j4vC93:PRd9gEgxSe1gsOKufpTsW

  Score

  10^/10

  cybergatecyberdiscoverystealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2