cybergate | 3458363d34b7f09be0afef58850b229ef405407957d4efe3dbd849f105b72507

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Freespace 2.exe
Size 328KB
Sample260910-dzr36sel71
SHA256 3458363d34b7f09be0afef58850b229ef405407957d4efe3dbd849f105b72507
MD5 36b5b77a3ed19cb50df4fd83a8e34b0e
SHA1 a7a3a1bebb1ac957927b0e01a66b070f19ab1f1d
SHA512 28ba63830b61569296618d5c050f9c964893fc3d69ecb9ecaf56a2ea038cfd8335e2f8b616a25c4bf85f85038cca94a821bfb7c2b4b46f90fe5ff31da0b74fcb
SSDEEP 6144:Y4ABF944oNojDuUlWojDuUlupAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXK5M:nUpSeDuUlWeDuUl1GLE0kuGnESBG
TLSH
T1CE64F203BBA095F3D60809781C2B87A4762ABD361DA756537BED3B4DCC7E281991D0CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remote discovery cybergate persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

remote

moeckel.zapto.org:83

Mutex

1SNV2KP6T2H2C1

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
rundll32
install_file
rundll32.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
kartoffel
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jaffacakes118_Freespace 2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundll32\\rundll32.exe"	jaffacakes118_Freespace 2.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jaffacakes118_Freespace 2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundll32\\rundll32.exe"	jaffacakes118_Freespace 2.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{JO04I2S4-X17E-J367-N76H-P0B25O62U53D}	jaffacakes118_Freespace 2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{JO04I2S4-X17E-J367-N76H-P0B25O62U53D}\StubPath = "C:\\Windows\\system32\\rundll32\\rundll32.exe Restart"	jaffacakes118_Freespace 2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\rundll32\\rundll32.exe"	jaffacakes118_Freespace 2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\rundll32\\rundll32.exe"	jaffacakes118_Freespace 2.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32\rundll32.exe	jaffacakes118_Freespace 2.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4876-1-0x0000000011370000-0x00000000113D1000-memory.dmp	upx
behavioral2/memory/4876-4-0x0000000011370000-0x00000000113D1000-memory.dmp	upx
behavioral2/memory/4876-5-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral2/memory/4876-10-0x0000000010410000-0x0000000010471000-memory.dmp	upx
behavioral2/memory/4876-70-0x0000000010480000-0x00000000104E1000-memory.dmp	upx
behavioral2/memory/3352-75-0x0000000010480000-0x00000000104E1000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2904	5520	WerFault.exe	88
4168	3352	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Freespace 2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4876	jaffacakes118_Freespace 2.exe
4876	jaffacakes118_Freespace 2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4876	jaffacakes118_Freespace 2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4268	4876	jaffacakes118_Freespace 2.exe	80
PID 4876 wrote to memory of 4268	4876	jaffacakes118_Freespace 2.exe	80
PID 4876 wrote to memory of 5520	4876	jaffacakes118_Freespace 2.exe	88
PID 4876 wrote to memory of 3352	4876	jaffacakes118_Freespace 2.exe	92
PID 4876 wrote to memory of 3352	4876	jaffacakes118_Freespace 2.exe	92
PID 4876 wrote to memory of 3352	4876	jaffacakes118_Freespace 2.exe	92

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4268
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Freespace 2.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Freespace 2.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:5520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 84
      4⤵
      Program crash
      PID:2904
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 96
      4⤵
      Program crash
      PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5520 -ip 5520
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3352 -ip 3352
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 222KB
SHA256 ef5695faea1bb76149cf21224cd7e248f56996104e5bc3116a5e374df175f400
MD5 6ade4597697b7fef08840490444be29b
SHA1 8090b11dbd6bed703a70a84125541510bd882220
SHA512 0ebeb9c1a0f8327212cd0d0fcd37c2078049aab8cf69b22e87acfd51b3d2559e756f4fc51b6e58f8e8786ee53d325241f234494a61d9f65ceab936a7261cd148
SSDEEP 6144:0pAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXK7:HGLE0kuGnESB7
TLSH
T1BD241213E177B8A50B0DBA281E3DE5C09ADCAF7B4D2BD29B3B5C007C945C3A5A7091D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3352-73-0x00000000042B0000-0x00000000042B1000-memory.dmp

Download

memory/3352-75-0x0000000010480000-0x00000000104E1000-memory.dmp

Download

memory/4876-1-0x0000000011370000-0x00000000113D1000-memory.dmp

Download

memory/4876-4-0x0000000011370000-0x00000000113D1000-memory.dmp

Download

memory/4876-5-0x0000000010410000-0x0000000010471000-memory.dmp

Download

memory/4876-10-0x0000000010410000-0x0000000010471000-memory.dmp

Download

memory/4876-70-0x0000000010480000-0x00000000104E1000-memory.dmp

Download

memory/4876-74-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/5520-7-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/5520-6-0x0000000000570000-0x0000000000571000-memory.dmp

Download