Extracted

• • Target

    JaffaCakes118_8c98eb666a6d89d604e514fc75bba87f

  • Size

    976KB

  • MD5

    8c98eb666a6d89d604e514fc75bba87f

  • SHA1

    089c24d6910fc10b03bc04a67657a8fcfd8ec1ae

  • SHA256

    7eabb3c686efcf9fb94cb294cf762df34a1c1cfa9c561e2b805f0e3e3c82d397

  • SHA512

    7de1225c30a36e0120246dd014b1e6262475ae120301325d20e44999ceb1991cb5a64639d5dff90aa99d01d1e17554c434fde994939e4d0f9558f857ecf9e34b

  • SSDEEP

    6144:P5fRY89rex6LS4ujzcaxqVddXVmVpgE+kbDh8K7NZsskNMxua1fyH6sCNkoHELWq:RJAP+kb18Kn/xuYyasx4XTOCv7HDPAg

  Score

  10^/10

  cybergateremotediscoverystealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2