Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 04:05

General

  • Target
    jaffacakes118_2000.Referate.Ebook.German.exe
  • Size 381KB
  • Sample260910-enn3tafk9x
  • SHA256 e8e1f3a6ef3b3232775f92548abae3f8da6cb29d1cfcdef653ccd76b76b1932a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.05.1

Botnet
  • remote

C2
  • freewaybong.no-ip.info:6666

Mutex
  • BQNA36DKML4H6J

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2000.Referate.Ebook.German.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2000.Referate.Ebook.German.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2000.Referate.Ebook.German.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        3⤵
          PID:4852
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2000.Referate.Ebook.German.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2000.Referate.Ebook.German.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4756
          • C:\directory\CyberGate\install\server.exe
            "C:\directory\CyberGate\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4164
            • C:\directory\CyberGate\install\server.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5064
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 592
                6⤵
                • Program crash
                PID:2508
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5064 -ip 5064
      1⤵
        PID:4528

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 d0557cbd27e55b0ba1b726b70f0bb2f86344be15dea0584de9565ffa1fd93771
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 8e9b579d87b7d8e70de830e3febc9549ab1bd395b5a0ec7ba185af8c16bd0b4b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8380e70706927e0d4297767e6f9c0b3d96b8a235969a6d640c7987429b7cdec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8254d972b290d92a98201aaf2473ed29400ad025c8ae60ec0e665a52719a67e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 322b7546b9fcd1d0c77de653a665d83d9fe966ba598991823ff2b2de16cc9822
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0aba7574130ad2bb5f1158842042cdf3a4757df1bfa160d46a0738dfe02d76ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3723efd626ed33bb041875916f8f2b3f941e9682416e38e309b46e3589201dd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f44bb3e9e55f6ab9c57d888cc6afaee087eab84b999418501b2f9275e4aa0487
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7e3d2111d87f3d4298df042477bf1eb67956a5bcb623eb0c8cee9c79fee75f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbf207205333ccbd7636588d5c1098ab9540682d723072915043210ee247ef43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 126f3a032b7ba62fe028bb5bfb3f38e2c92ef0f5206907b9728a67fb4c0a3e0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aefc80272c2e1e504d2c27a5f58a343b933e49087752aac30542c7366a37eba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5103e17f11f6f0448ba80b943af6fdee056210376b437aa73a0d4446f38a6bad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84972028a472d1af1a8a2fa4eae6ad937546aca0ec86a283262f4094a58ff9d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e94af0cdcfd08dd5ded82d3b4b5144aae6cf51886566e6e213e4788de513dd5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f731532783865b92fbc39a9a59a07ca604a8c79f1859991bd2378c9d2039eba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fd95b693315a3ad5ec4f1d0a81f45614c77bc6358b608523361b42f1c26fa06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3663e801f2c4ee1d841f75544d912bfa84a7a6b9276af00489c524fec4c2579
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2331b89f3ba68bab6ec0aeacd238f246cd2545047a680c2039018e2dbd423415
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b929adbbf8d1910d97a1a3f19c0d70208706f505ea7cbf779f2d90e54c8c88d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adfa3d223b08860a16d6e7066da81525567b0ccd8ca56490187e6740a48da058
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e56e1699f38368b07c0b0830cf6544fd0afe796ed8b6cfed4d3bdcb7f5d4446
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21a2ca57f90436521f005ffa3dba41956b26ad91cac787044abdb3c8e8990b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9909fb5fcafb315f0f75f94f532269802a9b847822ba5c88b4c1f90e04dc977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d99686e59037acc496113d04d204f1aab41c130bae5e0b4561412845589e62c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c44b469c096f55b9c8d8f607712837c6d508bbf7f302ccb0c2c9c34fd2fcd3b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3983a59894c832abef0f79d29d66febc550caa43463b38ba4df1bec6eea4941
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c52e53b97e9a1e1fd7994a0a5a4f10ab380302e9df264ac99a222d0506d7e1cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85dfcb8c5ee1a3ad398e52482809b4b22eab996c148979b5dcaa02815a2db7c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 677fdbf022d8792f635b07273eeda6adcd0e23c43be0c23a45712b525c3b4b2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7d59e53df4fc9e6342f78988451fca87b6b949c4205ee76cc32be35224859e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87ad35912f3e93cd7cfdd9a3880d67d20ca2d285eb04b3ff7f8efc56ee24aa33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 549d8b416790da1d4a4599c9065b2666d47036a32c9a9d743c6a2f830df91f25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a916daa7c0ac41052824d73f283eb61cda388d31d7598847eefaf266ebdfdb24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19e1382b408cd88eafe087d8c1ba201055707e23caf3488f971648333bd37570
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e476d026f831270f08b9cc6a68ebe0dc4a16f93710ad3a785e1a718ea3a3e0d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d26152a05b4eb034e27ec7eb00c7cd89e61afde3d6b71f16e4076f5a7c19e487
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6c69ce972ebf747c28bf19fc4be3ced97d6d56c2b4664c7320338381a285fba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e721146e98cbac25834b079830904e1f525fe4af878c9e837bcfefe35b862179
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26fd99757aa8462d036e698593ec5a9baefe893d07b5cd8e3c775f822c6e756d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7b98e8ff2c8de5f6ed376a2fad92e9f1597448cb640ab7fa5ca134b5f882dd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0690a2a1a94fc494dadc8d52613bd9a434703d500763d71a48fa02476541e9d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5da39911b584a7e26ab058c39fa361f2a30abb1fbedd63caf6fcf828d222b7f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ade79d493daf145b7e27f60ba2dcb83f7b50e8798c90edad12e14e4b12f78a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81e5007962a863d4044215d33a5799f330473a4a7bd5078b145472d50ed296ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5ca6102f28356deba47d3ad37fbb8a287b2d790870f718aeb88a873c5562489
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5aedc3a3a8551372b909eb21f8e8c59b0b33530b956e94f0ee7675c578f6512c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ddfcfb0cb31b5e1a63b3e34e89306ebbe1cf0b4b426707edd4cf31947a86a18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2e0e9438b704d32f8aecd14cb703b033f28aa334ea198191516ca29e89c3a37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0010197c79cb559d29611070705b79606d5fa73aeb450fd6b666f8aa5c485d3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39b2110cad2304fda74bb316605c7d32864011750b7086c4222696f24d21c62c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c48f418404e666de64b58d02d598de593e1c66ce8687bd4cf5e339721cff97f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3695097c46ffa55adf8c0babb1c404ecae6b69282899be36f7845f7a0bad93a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d8acbde2f798eecf25366f5ec7b950a7c0d917a0f57710a6afae7e872ee55e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56baaa42e95b7d84308a8838a5023db3a71e0749b08a6568dfeba99cf6562f83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b0db3f5be65fc6cf2c3b83a2b9c0a0c43a310c4f4af220f41a80b4fe31b9ce7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de27d49a5e4d086cf62a4f5ee55c29c62c78543089425b8791aa92d144a0fd85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbe573a623f3504704d0aeccdf0c1274563f3e628453d719e8ae67f33f845b24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fd94310c22adfeecb3a8694c455d67ae1dfafcce34805d0d4a180fc0175555d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e78a0940cc3c625409f60b84666f552263c516dde39223d5d57b48e3a9abc16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ef779d273afccb0dd93f54f894f000018abef7c373d1707ec8cf29ea529933a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4287371b603eefe6587a8f01b99c9a234a82e992a62b9dfa3cb2a16d2ef6682b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8da8a2674cc3823b2a5e20a544b482b00372749c6b5ad503fdbb56efd8687bfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad511ffccbf8a5a074c2a47591588292e23fe73cb01365bf42e215a8556b91f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c161639f975184436f4ae176cdb68e450e58cd1f40d5436af8df7aa25af4347e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce9cd73e1f8e394f78ea53fdfc6eb14332ae80f9549261a91fc8383f4956c6d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e05bdef7405549d4bf0914e2d71c78d86845249f3a4f15b6b23a40c2ec5a88b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb444859768517089238b8a520495a028e20fe196b4c3a493455a70e0c80b967
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 935b171cc54c858c8a34516a5cb10ba859f4acaaf87d8e5c330215e270fd2555
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07b4928ee7756efa786f8d63b21ba9aed7a4b516a3e48bc7f10a04ba25dbd912
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d378e63a231da4169a45f3be5fb814b1b672c9ec2a6201536b2b9a7cfdb1dc22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5742436ef4e252bbc5f111be64c517cbef3917a647c327468ea636bc492f368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ef15f506afabb2f3fd1b225bc5bc2337e50ac86528074a388bcedeca3cdbe80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbbd9990b7ea6643836d6ea50a1f37162f3f868f76556b8ec2f694f0a803920b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1098ebbcc64506b97d2c2694002a4053d4dfa4da8101f8db569e4346e1ac7f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c05f7da7067ad59ba7e214f77257e22380c490d78b529a1c12568fd80795394b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3cc8679953d82f4e639d7f62040eea73d72f68ba099559a3010b7a657771b5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33cfed0829696adfc1ed6ef34c83e66b470ba78cbe5fbbb745f12cd5150731ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97da1c352f6759ac96b068871fa35639306fc51386021e8e8bc07df883ba192b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c09f302daa731c5f56c6167606854439f90a40eef4d7a409f45133a57e5d33f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cbdd840cae2a39460333339bb8d9b7e8a16c3f9ee047557f9d913ebeeb939f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff9020af110f03311875954b18201579bde37aec6b7475cf28e1afb1b26672ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51ed44e9c2c2bca1f95a80f62ee92c9656aad0437941b4e96b7f8275ef0a1b33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49f2e6d9e388b57ec83116e340fdcf07c70e6a47da14bb0bcc5dce75117a6b69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18a1955f28e74ca04f49734ce8e71bc545ce07f77f651eceac43ce30776bfa62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a0cee4b0c0946a81ef14230f3dd114d15f83ee6cddabbdb7d1f5c82453a9a41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686331e1c7d9148b1e63d4c7fa538ee6c4d1891f903ca18910396f51f80663ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 143a47fc768428e187943e2364e02f15346b79613e605b27460939455ea1123f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac65f50a4f4f01217eebf477e213c7764876add34ec2bf3ae689214ae4ec13f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da7af10ef5ab925581b746aa901bb7cfd7437866a3436aabed574551a677de5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8e32944208793dce3b928b21a2c8b6b23e7971fd160a070cf5b8420b46c2566
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fe2da643f69a468e8bb3e18a79a80ca576770aa70410c54af0b6e64f12112c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c528e75985be327963a1ed533bf3c613f3880ef951d01bea53033c36ac4ecd30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b6edeabc2eaef382132c4737b8cfe03cd7e0e6907ad3414dc042a78466e178a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f79d41cea14feffc3f1b61aa4f2de59cbce448b1c9fab8c39c66dc088a7812a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b20330268ad4de5970df7880e64911d9b695c1ebee42ca4ce188f1e47054b981
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d64c3640c4ff09e5bb64fae5fdf56e9ac7b5e906f3a0996f8331ecbc4b8f2cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19c041860fec55f07ef81bddb2eb2a4545f505d2e551e9a4249386917652d227
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14b37372f033979630af3b91a06410946f3b714e32b91c842aeb7fab9cb76c18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b13ccb19e96889ed19b24d57f85ef5f65ea76d44cef3fe9989a02ef54ab7c17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 784cda1e119121c88345bf5a2b46242bb68aa65f6f164b57c7bae63bfe6bb716
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c8f2d4f31d5ca6d68a2f75431a0b8e6c2efaf0b468e50984b0fb87942d0af53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd4ffd9c10e6f9cb630755b1ca43626e3135d72430136a1bf4ee5bb8878336a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc76967eff3d81fbf216c1f6f9f773dacab4a3a74b2c228ee5a0ca0883ab3742
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13ff6dd555775ef73bedea230c30cd13f662ed521af0944b55757cab5dd8f2bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29b4af1003264501b249712b98d85576ad880118dfaa6bce3677945f09cba83c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04864fd752dba9a59c682cad0470ece142c3266e6d8283975bc86eddcb57d03e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f784f982880744082ad2c2f7b787fb60e1485cd765eb33729ba215eee2981ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d77846bda0d7721680867648da380ca866af8215c608e0294dc897c2269a0a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e66891a26324d698c928d80f8939d52e127a7d70e476f72ae4625423f9d0340f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1f9e7b73f7476fb9ffd3c218a24d7e06b40714043da159bf5bf12eefa28caf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a0975e5231f8fb38df3df8a019f4a36f7ccb129fffe46ec93b3368f668880bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b6e4fdcc0b344d1259533a0fb142171f92ff58819e3cb5849f5b0592edb7875
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62d77996b41b50b0f0ff074516d67e851725d39029b8bc3dc4c6ebcd87e8e78f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc83683d80402e84935182812b4635d28cf2a8c17dcaecf11aa494a64d898e09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1221fc45cbae1cd493afae19b8d74a4a88325c64fec7882d2f2c016c6af1aece
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2911fae3b60676e76c9c43ed6372e779311c5cdbeb266f2c85ca1eaf26a04563
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 075f72648e4867ad9642e1a78b1c3b8829382f0a454a3d05a4433c33831fcbeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7c7e76a8c44aa9f5795afdaf2cf20f891602d0615e5010d8cfd3b6d3ba06e88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3cd9ccf80ed65bed0bf36cfe2b7cb29771df333f65d0efebdcf5f640a6e3b22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4141970907b73c074c91b841dca26909ff2e014d43f7ba54b360c737a85329f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb16136a12107a4c8d4c730d7b6b4c739b7eb762c82346389e77514d92462b55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8eaf4dd2e3c576c7f717137329424f342adc9332f1848747595cbd8bfadbff5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16432191ccc4fd640b98a96a5ae25bd0ba4c9fa0cc0d7d6b3fbc3d5517b2cded
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad030b98b78e98298694a215ee6e5eb1827d43c3adaad3a514f58e442ca6209b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5dd955809f7b7c89b5e83a4f806cb91b7ac1da67f10009bdd6eb0630e3664c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cca105d1af4e870cf58cdd71bfa6e43e64eb72de50072396a53e6628402068e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92d7259f28f4aad078659430660787a28c965b5060d2fd6206c45171b089eb4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bc49f1b1767603db35913de66d0708ac5df776387d58adfa08bc1af0725df12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acc12929bd2577a463b294ed70bacd35277b2181fb6103ee008e1028e7fa595c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fcdcd855eb720eededbfd6dfa347aa53b7636522f481d49c9b79a2e842cc91a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 588645ae2b37a0d026d9d578949b7dea6602d9d7720436a9b396ec04a0a2526b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b484a4dc0d3f081888389325608ca50ad0ac1c5c5deaad1e1e6a9c05421dd312
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c67db635690ab00a03690bcb3feee0fe2dddc7e997cb4e79b26e926fd1c6053a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 394280726a3642d71bfe1d7c69edc66ab3c017c1207cefa6277cc6611c3aaa5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce6ee80ff03012044c0a99c701406eea60683dbab382df54c2c1555759eb2e18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c991fc30cec5d91d084a90eeab0c764a47e76bd3cd1d1c05f12331fda29b86ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15a37a612b734bcabedd67d8e9759d4336697ce252365d29dcfbb15aa89f47de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c75201c6b290291695ca5f5de3513ff4d25a293e246ed1b509a4ce5e1e697c04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9220cf08a696890af9f0c568f7f80cedfdb0e2c803c76dde39b661526ef57a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9fe85ff1eee5655144bc68f96e34dad42cb7328f47b23fb00077506b91026f9
            • MD5 SHA1 SHA512

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\directory\CyberGate\install\server.exe
            • Size 381KB
            • SHA256 e8e1f3a6ef3b3232775f92548abae3f8da6cb29d1cfcdef653ccd76b76b1932a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            memory/2572-10-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-2-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-78-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-4-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-3-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-9-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-8-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-74-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2572-13-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/2572-16-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2572-7-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2572-33-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/4164-102-0x00000000017D0000-0x00000000017E0000-memory.dmp

            memory/4164-103-0x00000000731F2000-0x00000000731F4000-memory.dmp

            memory/4456-1-0x0000000074732000-0x0000000074734000-memory.dmp

            memory/4456-0-0x0000000000E20000-0x0000000000E30000-memory.dmp

            memory/4756-91-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-113-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-17-0x00000000009D0000-0x00000000009D1000-memory.dmp

            memory/4756-77-0x00000000043E0000-0x00000000043E1000-memory.dmp

            memory/4756-18-0x0000000000B50000-0x0000000000B51000-memory.dmp

            memory/4756-79-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-82-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-84-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-80-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-90-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-83-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/4756-97-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/5064-109-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/5064-110-0x0000000000400000-0x0000000000455000-memory.dmp