Overview

overview

10

Static

static

3

9b0f249590...18.exe

windows7-x64

10

9b0f249590...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b0f24959014de595ed453f20d4b0aa3_JaffaCakes118

  • Size

    164KB

  • Sample

    241125-m3l6rszlgp

  • MD5

    9b0f24959014de595ed453f20d4b0aa3

  • SHA1

    b7d7debb1b40c81585f8f5dec531b6a1d01fa7fa

  • SHA256

    fea51b17878740131cb927f0c11872207ac21518d0c886d308a601286f8573e1

  • SHA512

    7f50f8740665de98ca00c4ee85d913746a759030c5e0d3bb6febc45503ece9eb85debefcb40e4ad32e7f322cd3775236c3f6642a1fdab3e760a42945b2681792

  • SSDEEP

    3072:Fm+Ln2uL4rMEBowvKAxnQPZ9J7dhPvqmBJcOtNK12An:D3jEySZQR9J7P3q+GCo2A

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      9b0f24959014de595ed453f20d4b0aa3_JaffaCakes118

    • Size

      164KB

    • MD5

      9b0f24959014de595ed453f20d4b0aa3

    • SHA1

      b7d7debb1b40c81585f8f5dec531b6a1d01fa7fa

    • SHA256

      fea51b17878740131cb927f0c11872207ac21518d0c886d308a601286f8573e1

    • SHA512

      7f50f8740665de98ca00c4ee85d913746a759030c5e0d3bb6febc45503ece9eb85debefcb40e4ad32e7f322cd3775236c3f6642a1fdab3e760a42945b2681792

    • SSDEEP

      3072:Fm+Ln2uL4rMEBowvKAxnQPZ9J7dhPvqmBJcOtNK12An:D3jEySZQR9J7P3q+GCo2A

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks