Extracted

• • Target

    JaffaCakes118_3ca3c2a849524f910d771a1300fe2d52

  • Size

    670KB

  • MD5

    3ca3c2a849524f910d771a1300fe2d52

  • SHA1

    a5dd72ae84a7ad3c3489674589ec6385dd365a68

  • SHA256

    d1fb6ee648be77f6ab005eea76d8c1be4beca04a5c17f4809949f23bc0c8ba63

  • SHA512

    6b47ce7ed7a318f10482f46f2cdcb0821d8620ccee1d1042382fdffa9dbf0df2927e707bd03bf3d3e02013a5723311ab969207f07c21a88636b87d5499910fd9

  • SSDEEP

    12288:53VRPcEDYVuL4qxnDJoxKxzqvAy4VGCQw6oR2K3dW4fI3d/:XR3YVuvxnDJfkDBGAAwZ

  Score

  10^/10

  cybergatetencentdefense_evasiondiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2