cybergate | 848128005d7bcf98a0969ab31634df8fbecc15864e8cdfd34919e3ccc343982c

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1835.avi.exe
Size 16.0MB
Sample260910-exkfzsfd46
SHA256 848128005d7bcf98a0969ab31634df8fbecc15864e8cdfd34919e3ccc343982c
MD5 9a8e9bfd8cbce98ff1e521f0b4fa5925
SHA1 6e2dcf1b26bcb25de32c5c94616420580dbd4a25
SHA512 c392f7f556be7eb80082e2d04a7b29d6723b97574cfcd52328d7430c7583664214f635414d26b102b710dcc98d71de446620dcc86165bda55d369431b6451258
SSDEEP 98304:uRFNiBmGBi+iFRXn6XtSSWWKdyepfioXa:A
TLSH
T19CF6D02C9522F2F7C1BB89F078990D4643FD02715B479F27446D267A2A4F929B24C2FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkness_crypt_1 discovery cybergate stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Darkness_Crypt_1

winupdaterwindows.serveftp.com:35852

Mutex

757W33SKC5SFHP

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
system32
install_file
svchost2.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
pearly

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3428 set thread context of 564	3428	jaffacakes118_1835.avi.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1835.avi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3428	jaffacakes118_1835.avi.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89
PID 3428 wrote to memory of 564	3428	jaffacakes118_1835.avi.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1835.avi.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1835.avi.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1835.avi.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1835.avi.exe"
  2⤵
  PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-2-0x0000000000400000-0x000000000044F000-memory.dmp

Download