General
-
Target
ef935cf2d475a56ccdbaba16a5da0206_JaffaCakes118
-
Size
177KB
-
Sample
241214-thnx7aypem
-
MD5
ef935cf2d475a56ccdbaba16a5da0206
-
SHA1
3e9c9fa7804a76affa23ccad289e4dd0ca5636cf
-
SHA256
022f6814e9b899b018dd57d851b35624211af54caa4f78387412c2cf96f4b799
-
SHA512
4556ecec8f2447e5916ac2ed22be0aeb4f5116911247087b3dfe1368959ce1f0a8055316dce646fd454ca13768994f16564c42d55bda96e96278b7aa2acbd5c7
-
SSDEEP
3072:ztQ/wltNDbwnEELshZ/wN1NujLZ32Y7c6Sm/s+7tP0XPj8A/tb+Fry/:6/wlPDbTEgEN14jLwx6Sf+7KXYab+
Static task
static1
Behavioral task
behavioral1
Sample
ef935cf2d475a56ccdbaba16a5da0206_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef935cf2d475a56ccdbaba16a5da0206_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
ef935cf2d475a56ccdbaba16a5da0206_JaffaCakes118
-
Size
177KB
-
MD5
ef935cf2d475a56ccdbaba16a5da0206
-
SHA1
3e9c9fa7804a76affa23ccad289e4dd0ca5636cf
-
SHA256
022f6814e9b899b018dd57d851b35624211af54caa4f78387412c2cf96f4b799
-
SHA512
4556ecec8f2447e5916ac2ed22be0aeb4f5116911247087b3dfe1368959ce1f0a8055316dce646fd454ca13768994f16564c42d55bda96e96278b7aa2acbd5c7
-
SSDEEP
3072:ztQ/wltNDbwnEELshZ/wN1NujLZ32Y7c6Sm/s+7tP0XPj8A/tb+Fry/:6/wlPDbTEgEN14jLwx6Sf+7KXYab+
-
Cycbot family
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
Modifies WinLogon for persistence
-