General

  • Target

    ef935cf2d475a56ccdbaba16a5da0206_JaffaCakes118

  • Size

    177KB

  • Sample

    241214-thnx7aypem

  • MD5

    ef935cf2d475a56ccdbaba16a5da0206

  • SHA1

    3e9c9fa7804a76affa23ccad289e4dd0ca5636cf

  • SHA256

    022f6814e9b899b018dd57d851b35624211af54caa4f78387412c2cf96f4b799

  • SHA512

    4556ecec8f2447e5916ac2ed22be0aeb4f5116911247087b3dfe1368959ce1f0a8055316dce646fd454ca13768994f16564c42d55bda96e96278b7aa2acbd5c7

  • SSDEEP

    3072:ztQ/wltNDbwnEELshZ/wN1NujLZ32Y7c6Sm/s+7tP0XPj8A/tb+Fry/:6/wlPDbTEgEN14jLwx6Sf+7KXYab+

Malware Config

Targets

    • Target

      ef935cf2d475a56ccdbaba16a5da0206_JaffaCakes118

    • Size

      177KB

    • MD5

      ef935cf2d475a56ccdbaba16a5da0206

    • SHA1

      3e9c9fa7804a76affa23ccad289e4dd0ca5636cf

    • SHA256

      022f6814e9b899b018dd57d851b35624211af54caa4f78387412c2cf96f4b799

    • SHA512

      4556ecec8f2447e5916ac2ed22be0aeb4f5116911247087b3dfe1368959ce1f0a8055316dce646fd454ca13768994f16564c42d55bda96e96278b7aa2acbd5c7

    • SSDEEP

      3072:ztQ/wltNDbwnEELshZ/wN1NujLZ32Y7c6Sm/s+7tP0XPj8A/tb+Fry/:6/wlPDbTEgEN14jLwx6Sf+7KXYab+

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks