Overview

overview

10

Static

static

3

ec9062adfc...18.exe

windows7-x64

10

ec9062adfc...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec9062adfc65552a82d719f4932c361d_JaffaCakes118

  • Size

    154KB

  • Sample

    241213-vvv3psxker

  • MD5

    ec9062adfc65552a82d719f4932c361d

  • SHA1

    96c5ef9f64b07539671c960cfcf3012e27e6f33a

  • SHA256

    5b1215f9c6427d230ac02aca1e84c7f81820bf08d2dd02376d1d84e40e0037cf

  • SHA512

    e46ab4450c92a1546185de5f67e9ffe9131aa43eeb423712ddebd28c9e82857fee9491c108bb5e4ffd00311fde3828c73c33ce5e73dd39de26192ba655172fbb

  • SSDEEP

    3072:dXo/UUiDDlZe/dYmxzdhoCBWZ7ehyVvB27CVKuZEIrv5:dXNUAlZeeAnoCye8527qKkrx

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      ec9062adfc65552a82d719f4932c361d_JaffaCakes118

    • Size

      154KB

    • MD5

      ec9062adfc65552a82d719f4932c361d

    • SHA1

      96c5ef9f64b07539671c960cfcf3012e27e6f33a

    • SHA256

      5b1215f9c6427d230ac02aca1e84c7f81820bf08d2dd02376d1d84e40e0037cf

    • SHA512

      e46ab4450c92a1546185de5f67e9ffe9131aa43eeb423712ddebd28c9e82857fee9491c108bb5e4ffd00311fde3828c73c33ce5e73dd39de26192ba655172fbb

    • SSDEEP

      3072:dXo/UUiDDlZe/dYmxzdhoCBWZ7ehyVvB27CVKuZEIrv5:dXNUAlZeeAnoCye8527qKkrx

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks