Overview

overview

10

Static

static

3

a389fd9a55...18.exe

windows7-x64

10

a389fd9a55...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a389fd9a554d939f099751280275793c_JaffaCakes118

  • Size

    169KB

  • Sample

    241126-xgl9ratphx

  • MD5

    a389fd9a554d939f099751280275793c

  • SHA1

    fec10824e1ca87a04e52b377649aadd7dec3d39f

  • SHA256

    b9066ac867a7adc0a4d0c97bf2d0266bfa7509cc9ecd146ad337b82b71365437

  • SHA512

    c8f4a87e09ecc81330b1a6b5b1d6ac315608ba5d0b5af9edb93ebae1682b7b6bbf95c0f8d3eee58163152a64de9874529b9bc50fa13b063f9e601e479fe736c6

  • SSDEEP

    3072:+pQ2fNwW2xMcMMCJCbPcDnslHetEUADLFi+bBxQ7jqUWXW5:+pQ21ZUvMM2LE+tuLFi+bBi/Np

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      a389fd9a554d939f099751280275793c_JaffaCakes118

    • Size

      169KB

    • MD5

      a389fd9a554d939f099751280275793c

    • SHA1

      fec10824e1ca87a04e52b377649aadd7dec3d39f

    • SHA256

      b9066ac867a7adc0a4d0c97bf2d0266bfa7509cc9ecd146ad337b82b71365437

    • SHA512

      c8f4a87e09ecc81330b1a6b5b1d6ac315608ba5d0b5af9edb93ebae1682b7b6bbf95c0f8d3eee58163152a64de9874529b9bc50fa13b063f9e601e479fe736c6

    • SSDEEP

      3072:+pQ2fNwW2xMcMMCJCbPcDnslHetEUADLFi+bBxQ7jqUWXW5:+pQ21ZUvMM2LE+tuLFi+bBi/Np

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks