Overview

overview

10

Static

static

3

d1cf59b3e6...18.exe

windows7-x64

10

d1cf59b3e6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1cf59b3e6d7bc3cdd521e7158e65d20_JaffaCakes118

  • Size

    167KB

  • Sample

    241207-lr6klaspbk

  • MD5

    d1cf59b3e6d7bc3cdd521e7158e65d20

  • SHA1

    baa2f928205102668cb27a8a4e3e6462850ae6d7

  • SHA256

    ce69fc82fe74b2e45813d029d908d8ec4d5a788df80c823abe40e11f0a08325b

  • SHA512

    d08501c0315956ff77dc084325550e198f845e64a32c69de63970ae87fc2740a0cfcfa9dd00ddf102fba8e2e3d60c4a146558662850880cb56d90ec444570f1d

  • SSDEEP

    3072:1/JT+YPf75ysw4dB6eWth+WU8wTtNUFLwvPITiyTRbd0v0m:pJy+24dc7h+p8wwFZiSRbd6

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      d1cf59b3e6d7bc3cdd521e7158e65d20_JaffaCakes118

    • Size

      167KB

    • MD5

      d1cf59b3e6d7bc3cdd521e7158e65d20

    • SHA1

      baa2f928205102668cb27a8a4e3e6462850ae6d7

    • SHA256

      ce69fc82fe74b2e45813d029d908d8ec4d5a788df80c823abe40e11f0a08325b

    • SHA512

      d08501c0315956ff77dc084325550e198f845e64a32c69de63970ae87fc2740a0cfcfa9dd00ddf102fba8e2e3d60c4a146558662850880cb56d90ec444570f1d

    • SSDEEP

      3072:1/JT+YPf75ysw4dB6eWth+WU8wTtNUFLwvPITiyTRbd0v0m:pJy+24dc7h+p8wwFZiSRbd6

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks