Overview

overview

10

Static

static

3

e2db13ffab...18.exe

windows7-x64

10

e2db13ffab...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2db13ffabda7b98f7db88c055f1ed2a_JaffaCakes118

  • Size

    174KB

  • Sample

    241211-x1kj9svpct

  • MD5

    e2db13ffabda7b98f7db88c055f1ed2a

  • SHA1

    eaeec9fffa97e1e6ef70f143d7d33d713dab6ff7

  • SHA256

    7b0e5642727a1df949d626a625b679b3c1acba1e12e188e4075bf19170a20fed

  • SHA512

    dd78c7955737efed511d03d769ca6eb3f242a60c0dd9913b910702c1cfd1382d766e0cbd1da207779553848ab722cf1e9967a90598549093eaf9708a3e865952

  • SSDEEP

    3072:cN8KEFR+oANzCsw6063ag9ScrHe5pR1ohJxfe/NHj9c6:cAR+oAkE4gEue5v1og/p9c

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      e2db13ffabda7b98f7db88c055f1ed2a_JaffaCakes118

    • Size

      174KB

    • MD5

      e2db13ffabda7b98f7db88c055f1ed2a

    • SHA1

      eaeec9fffa97e1e6ef70f143d7d33d713dab6ff7

    • SHA256

      7b0e5642727a1df949d626a625b679b3c1acba1e12e188e4075bf19170a20fed

    • SHA512

      dd78c7955737efed511d03d769ca6eb3f242a60c0dd9913b910702c1cfd1382d766e0cbd1da207779553848ab722cf1e9967a90598549093eaf9708a3e865952

    • SSDEEP

      3072:cN8KEFR+oANzCsw6063ag9ScrHe5pR1ohJxfe/NHj9c6:cAR+oAkE4gEue5v1og/p9c

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks