Extracted

• • Target

    JaffaCakes118_410928fa1bd8674c6a701ec212a6407e

  • Size

    373KB

  • MD5

    410928fa1bd8674c6a701ec212a6407e

  • SHA1

    01e63ad1d74b99b7d5195e6866792bed80dd5a26

  • SHA256

    9093d8ce2e9ddcb9779001210e36b2acf9184366c8ae33b604f2988ea8fc7be8

  • SHA512

    73f7a89269c9b1002329e6af84a16063f788a9c8a07948acab7d34dec0113f06666cbf4ab609c678e9b143104d39723f86fd089257809b409d836d22aef8195c

  • SSDEEP

    6144:rbA+Pht8B3D1HMty0ibE9XnxLpHhES7642QyFkRzDSQ82nvkArR37h36:rM+Ph+jUnxlHhESuhQfBDDPvLrJd36

  Score

  10^/10

  cybergatecrossfirediscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2