cybergate | e1fc7badd28906c560c473647ab572bfc4d31a6e029950d331098fef337e3a47

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe
Size 488KB
Sample261006-sff9ws1vbz
SHA256 e1fc7badd28906c560c473647ab572bfc4d31a6e029950d331098fef337e3a47
MD5 36c85909b514739f3a964856f952dc63
SHA1 9a8ee0800ba784f66bff03f4cb6d91e7e2c3f1b4
SHA512 9d1a3c336e5b6587abda7958f1f0df40424b84391f7c954746c9514d7f8883eaa208960c5f94f3dbdb48ef68373a5b5228e2c0f985fed076bf47ddf116ace5d8
SSDEEP 12288:aLiTrxIT0dEbDGrjdZgemIzSpWFT/Rt0edaMOpqm:dxPEbIP7Rt3x
TLSH
T1B6B49DC80300E367D1E955F6B8823EE43226F5D943066668DD28A690F54ED7CCBDEAD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remote discovery cybergate persistence stealer trojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

71.72.163.117:83

Mutex

MKV6WDGSM88LSM

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Executes dropped EXE 1 IoCs

pid	Process
3592	307explorer.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\307explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\307explorer.exe"	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3396 set thread context of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3592 set thread context of 3712	3592	307explorer.exe	97

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	307explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe
Token: SeDebugPrivilege	3592	307explorer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 5168	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	88
PID 5168 wrote to memory of 4600	5168	csc.exe	90
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3396 wrote to memory of 2868	3396	jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe	92
PID 3592 wrote to memory of 3656	3592	307explorer.exe	94
PID 3656 wrote to memory of 4180	3656	csc.exe	96
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97
PID 3592 wrote to memory of 3712	3592	307explorer.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.StubRC.ila.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1fx0dmlx.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA83D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA83C.tmp"
    3⤵
    PID:4600
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:2868

C:\Users\Admin\AppData\Roaming\307explorer.exe
C:\Users\Admin\AppData\Roaming\307explorer.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ewwmnsvt.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABF7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCABF6.tmp"
    3⤵
    PID:4180
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1fx0dmlx.dll

Path C:\Users\Admin\AppData\Local\Temp\1fx0dmlx.dll
Size 5KB
SHA256 e15ec3df638dfe15f5993fa5cddfffc1c724a090308a4dc34e9b1e95a27292b0
MD5 c123112a4091078756f9df4112f17a3c
SHA1 8441f212a7e9cc2c03963cec0db36d255eb2cd03
SHA512 172b3831b77ae547d3594da0a11656d3863e085cfdfd52f28a2079e29f073f03471ea26447637c2d2c49ece61957fabbcd3e1ba7ec382b2c2c48006fe1b370c6
SSDEEP 48:6C9vwgAO8AwWzqH665Rn6yMnhaZZmbf2SRaY5fHYXVFJCBjTDyni1ZQ40lTbU9NW:t3A7lJ5Rn6yMhaZMRa4QazM40lYmwK
TLSH
T132C1824B9BDDC257E9EE0338B9AB0B1267B1E4314BB3436F05D091796CF23706B21669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESA83D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA83D.tmp
Size 1KB
SHA256 f5c2c85309e4eba8b72edd33d3e1b8c6c9762463298a740d308979d364784b5f
MD5 d1de13aa7afd7675b8d9c297d578be26
SHA1 51974838883dacee56fec2ece45c629429d461fe
SHA512 bbe57306d89d5443347913688821fc95ce3e33a0173766c22c4ca277ba4f2c82fd73d95de93f22b1673ba8e39dc18895e5ac5cd4d178f65fb909086f0ca49ae3
TLSH
T12D210A0557E9470AF0774B3179FA532BA224FDB4DFB193AF854002282C52514EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESABF7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESABF7.tmp
Size 1KB
SHA256 1cffeb1a91e31858f5e8a1916ba85ddf1a3a06fbe392a6db12b27b85c8bb0115
MD5 8dab2a8b586fba53209e6be170695b3c
SHA1 241c29df89735cde007387c7e33c00301c7bd3e3
SHA512 877178eef76433b89bbf3b986145796b78bf0a24b928b70ef0fe0cfc45dee873e0cd33fb001d9b65875ec1382f4fc86c6be9f6a6f97f0d22b8d04e477f2fc784
TLSH
T1B9212C4693E8470EF0B7473179F6136B9634FEA4DFA2939F8584022C1C51544EEF1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

ewwmnsvt.dll

Path C:\Users\Admin\AppData\Local\Temp\ewwmnsvt.dll
Size 5KB
SHA256 5ec2d87036273a1404a486906d88d8791e323dcca86b80e3f7533e1bfce26b52
MD5 a68d5625ca4fc468d0e5616290d41096
SHA1 fcd0b8289aaf45f057b83afa3faab7b7d663bbf2
SHA512 4f758539fa843cb04ab700cc493c9fbb90c7b4f357bd871eb9d8854149a215db4a7c86b873929afa83ffed9004032a92757fe57ae65293b555f2c2dacbd34dea
SSDEEP 48:6d9vwgAO8AwWzqH665Rn6yMnhaZZmbf2SRk5fHYXVFJXBjTDyni1ZQ40lTbU9EY2:y3A7lJ5Rn6yMhaZMRkQpzM40lYkHK
TLSH
T168C1844B5BDCC257E9EE4338B9AB0B5257B1E4214BB3436F05C0907D6CF13B06B61269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

307explorer.exe

Path C:\Users\Admin\AppData\Roaming\307explorer.exe
Size 488KB
SHA256 e1fc7badd28906c560c473647ab572bfc4d31a6e029950d331098fef337e3a47
MD5 36c85909b514739f3a964856f952dc63
SHA1 9a8ee0800ba784f66bff03f4cb6d91e7e2c3f1b4
SHA512 9d1a3c336e5b6587abda7958f1f0df40424b84391f7c954746c9514d7f8883eaa208960c5f94f3dbdb48ef68373a5b5228e2c0f985fed076bf47ddf116ace5d8
SSDEEP 12288:aLiTrxIT0dEbDGrjdZgemIzSpWFT/Rt0edaMOpqm:dxPEbIP7Rt3x
TLSH
T1B6B49DC80300E367D1E955F6B8823EE43226F5D943066668DD28A690F54ED7CCBDEAD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fx0dmlx.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1fx0dmlx.0.cs
Size 5KB
SHA256 922ec415710a6e1465ed8553838ddf19c8deb32b75da6dfaca372c1067d2d743
MD5 cb25540570735d26bf391e8b54579396
SHA1 135651d49409214d21348bb879f7973384a7a8cb
SHA512 553ce9d3647b196ccbd6612c06d301afac992130ec5c80fe8fa8a42bab4250053fad651227ff97d9fab4ba8aaff562d421236dc0b2b5d0d4a17430985dd07080
SSDEEP 48:J1oVrRWEmVrLyNrRh5orROzRs+/Xa+0j0lMYuoEXLrI5L77sUdQ0R9oOcJcrCHG+:J1oU5yrfM0lMdwLV2hHrAgW92
TLSH
T1FDB134180A14D30015F6222EEECA835DFA5350372FFE6A25B8BC51311FB61A4D37AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fx0dmlx.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1fx0dmlx.cmdline
Size 206B
SHA256 8c5823f72c66e8d4bb41348845e142bf6ca75344d78fc41dc284722490c19da6
MD5 31db3fbf0dd72963bf4081a8b3a3e668
SHA1 aab41eac2df1c55eb66b85186bc0421a51a1654e
SHA512 4c7df7fd934303726e0e2a7b726e7d02d89163009c0a1092d8f9c4d698ceab7d479ae1c06ff130ff903763cc4926f130d7ebcf7570919a52b7f88603692f9903
TLSH
T12ED0232703DEC76C15D8300710E0C1FCC17199056D0A7F644390C40C5277244B3F2701
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA83C.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA83C.tmp
Size 652B
SHA256 c5829ecffe87ace2c53272eb2d8912b09de1bf68710ef5a42ce90a687e898495
MD5 da7fbe85db5913feb6a7f268effd7a0e
SHA1 55c604c51cd5c1dda8b96e9899de35baa800fc77
SHA512 0543ea5688eb44fb7d189b5070ffc9b4ef85c7a1a5221ae855c82aeb65540897e7e7125e05ab90b5c57d4882bdeb95b43bf0b0096358d8370cf6d55ba4843b86
TLSH
T1B4F05E0967FC020EF0F35B30BDF6536391A8BC64DF3293ED555003192C656208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCABF6.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCABF6.tmp
Size 652B
SHA256 4746ba644fdca7a10449a403b0b042e5e94907fdf43d3c1dadad3fbc6bffb336
MD5 1943c3859e12fefafc6134fb575c24b3
SHA1 e2ff4adaf1984141f818e20bc6584c5d1e765340
SHA512 3bea9267aa68c6c8ffd7d87320cd344d279cef6d014a1cb57ab19b296d1f43b1dc16239498ad59ea064b0faa7a6f4890bda9bfce88fe86eecb2e25aefc855b6c
TLSH
T10DF05E4A63F8020EF0F34B30BDF653A395A8BC64DE3293ED5440031D6864910C9B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ewwmnsvt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ewwmnsvt.cmdline
Size 206B
SHA256 fc06dff6ba2a667b954375a98a3d1b8d7e8705537c690aa654a384b4ed88bf19
MD5 59fb874648bbaa84201647ab8001deeb
SHA1 3f50e7190af04a192120ad23396a0c7bbbef8374
SHA512 9ff83e4559db91a1e4611e6120555e717e8a12496f2413e8944a7b376dac1de523ca4a15556b464980acb777ba998bd25a10e85418bb6d918bed41dcb0ab56b4
TLSH
T1BCD0221A478EC62C35DA000B20E0C1FC82F24A0A2D8B3F794240880E1133089B3E1703
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2868-16-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/3396-0-0x0000000000E40000-0x0000000000E50000-memory.dmp

Download

memory/3396-1-0x0000000074672000-0x0000000074674000-memory.dmp

Download

memory/3592-19-0x0000000074670000-0x0000000074C91000-memory.dmp

Download

memory/3592-20-0x0000000074670000-0x0000000074C91000-memory.dmp

Download

memory/3592-37-0x0000000074670000-0x0000000074C91000-memory.dmp

Download

memory/3656-33-0x0000000074670000-0x0000000074C91000-memory.dmp

Download

memory/3656-26-0x0000000074670000-0x0000000074C91000-memory.dmp

Download

memory/5168-14-0x0000000074670000-0x0000000074C91000-memory.dmp

Download

memory/5168-9-0x0000000074670000-0x0000000074C91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads