Extracted

• • Target

    JaffaCakes118_6189cde6e87993cc1cca737c1a3b96d2

  • Size

    356KB

  • MD5

    6189cde6e87993cc1cca737c1a3b96d2

  • SHA1

    a58222b737018e79ca2ef7e827815ad9a9b4c77d

  • SHA256

    3a020844c13718221e93657c410ca3c0186526808e3be50d2f4afed8ca84caf9

  • SHA512

    f21ddbffc7200acb7fc03fe53932fe0500d76c078f2c72c4268455a1de2b3f4db14d17c033aa4c9b935062defe798f4563f4412c35ebe0c04f0d63b2361f4fe4

  • SSDEEP

    6144:5o16bTgoTZyxqg9n4dcMOw2MLOfP6VctxZJ2oQiKSPGFnRPoXsW9:5oUzpG0HCML4Bf21iK3nMs

  Score

  10^/10

  cybergatecyberdefense_evasiondiscoverystealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2