Overview

overview

10

Static

static

3

9d92fe3acb...18.exe

windows7-x64

10

9d92fe3acb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d92fe3acbdc5b305c88dbfbc35fa860_JaffaCakes118

  • Size

    169KB

  • Sample

    241125-yl9fhszmgp

  • MD5

    9d92fe3acbdc5b305c88dbfbc35fa860

  • SHA1

    74c8ff6afe4cdbc427c3c7120ebd4126f56bd5ac

  • SHA256

    b2942a6f0c86649e5e35ac6a5e1748c953a87c7c27e98d3d6707f22125bba19d

  • SHA512

    786116db37f708f23e8d7ff639d270e98a8f91795450f7cae3b61bdfba13c84e9ed20c3b909b165c3dd641854fcb08a431a889c65087d21c1732b75bd9ad3d0f

  • SSDEEP

    3072:eZckfPFOLpIk182brq4vAvG2X7j3bgSr7DHpKWxZ7PUz:4cuFUIk182Cd+o7jrgM7LpKWfQ

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      9d92fe3acbdc5b305c88dbfbc35fa860_JaffaCakes118

    • Size

      169KB

    • MD5

      9d92fe3acbdc5b305c88dbfbc35fa860

    • SHA1

      74c8ff6afe4cdbc427c3c7120ebd4126f56bd5ac

    • SHA256

      b2942a6f0c86649e5e35ac6a5e1748c953a87c7c27e98d3d6707f22125bba19d

    • SHA512

      786116db37f708f23e8d7ff639d270e98a8f91795450f7cae3b61bdfba13c84e9ed20c3b909b165c3dd641854fcb08a431a889c65087d21c1732b75bd9ad3d0f

    • SSDEEP

      3072:eZckfPFOLpIk182brq4vAvG2X7j3bgSr7DHpKWxZ7PUz:4cuFUIk182Cd+o7jrgM7LpKWfQ

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks