cybergate | 14238eac022adf59c119c21e6617a3ea8baec8d2e2f70229120777382f0979b9

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1816.avi.exe
Size 17.0MB
Sample260910-efgnrswgld
SHA256 14238eac022adf59c119c21e6617a3ea8baec8d2e2f70229120777382f0979b9
MD5 1efb0ab2c791963ff4a6b3d4e398fb89
SHA1 c0f0e75843028a2065db9a9733c66c9106bcda11
SHA512 f475e154a600ae4278958ca41e132bbd0092797a2117865aa3786641236e9c07526dec49110fe943e73925eb03620c38ffd1bd99049bf36e317c274c84db5f05
SSDEEP 98304:uRFNiBmGBi+iFRXn6XtSSWWKdyepfioXa:A
TLSH
T14C07D02C9522F2F7C1BB89F078990D4643FD02715B479F27446D267A2A4F929B24C2FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkness_crypt_1 discovery cybergate stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Darkness_Crypt_1

winupdaterwindows.serveftp.com:35852

Mutex

757W33SKC5SFHP

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
system32
install_file
svchost2.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
pearly

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 2196	3760	jaffacakes118_1816.avi.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1816.avi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3760	jaffacakes118_1816.avi.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88
PID 3760 wrote to memory of 2196	3760	jaffacakes118_1816.avi.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1816.avi.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1816.avi.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1816.avi.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1816.avi.exe"
  2⤵
  PID:2196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-2-0x0000000000400000-0x000000000044F000-memory.dmp

Download