Overview

overview

10

Static

static

3

be88cffe86...18.exe

windows7-x64

10

be88cffe86...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be88cffe8621fac69a509beee7ea17e7_JaffaCakes118

  • Size

    166KB

  • Sample

    241203-wf1v3ssjcm

  • MD5

    be88cffe8621fac69a509beee7ea17e7

  • SHA1

    50724a99cd4439557390a0e1dd5c9a1c1c15906a

  • SHA256

    b0fab27fcd887c18847ea2be66dffd34ea318abab6450d79286cac6da1bbe53e

  • SHA512

    2c4c28aadb50a90ec022ce14a2853d3c7129d137bfb877a44263319e63135cd264b835d6fd2cc7ccdf41a0d0e9b021d7f660e4720ab1078c15ab4f383e2d712d

  • SSDEEP

    3072:3l52HueAdXYP+MYv4WR0J4ryjYC5mjCyyelmz8pBDj4plzKIcjNa5S:1afUrgWR06ble8L4PZc/

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      be88cffe8621fac69a509beee7ea17e7_JaffaCakes118

    • Size

      166KB

    • MD5

      be88cffe8621fac69a509beee7ea17e7

    • SHA1

      50724a99cd4439557390a0e1dd5c9a1c1c15906a

    • SHA256

      b0fab27fcd887c18847ea2be66dffd34ea318abab6450d79286cac6da1bbe53e

    • SHA512

      2c4c28aadb50a90ec022ce14a2853d3c7129d137bfb877a44263319e63135cd264b835d6fd2cc7ccdf41a0d0e9b021d7f660e4720ab1078c15ab4f383e2d712d

    • SSDEEP

      3072:3l52HueAdXYP+MYv4WR0J4ryjYC5mjCyyelmz8pBDj4plzKIcjNa5S:1afUrgWR06ble8L4PZc/

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks