General

  • Target

    f708dd95a79a9b992ac0f49910151741_JaffaCakes118

  • Size

    165KB

  • Sample

    241216-dqndma1ndy

  • MD5

    f708dd95a79a9b992ac0f49910151741

  • SHA1

    580ad861f01001eca3547cbbd3618edf59909a9f

  • SHA256

    bbfba775d9f80238bef81390e896ce17d203e30201a3dc75f104f20b5ea0d855

  • SHA512

    91f62ccef9a824fc6db7a7fb9aa97074c5ed26623ba3bc9ff3eb3d3a1bd65954f90cc09caa263c45985a60b5f8db7111523ada3ea987d28afe7fc5051407e789

  • SSDEEP

    3072:ffdN7Ukm4khgdQHs5vfd+tOtv3AZi1z/lb5mxodrqwUPfzXYLS2xm5Hi:f104YsNFu/sB5yodewUzh2oC

Malware Config

Targets

    • Target

      f708dd95a79a9b992ac0f49910151741_JaffaCakes118

    • Size

      165KB

    • MD5

      f708dd95a79a9b992ac0f49910151741

    • SHA1

      580ad861f01001eca3547cbbd3618edf59909a9f

    • SHA256

      bbfba775d9f80238bef81390e896ce17d203e30201a3dc75f104f20b5ea0d855

    • SHA512

      91f62ccef9a824fc6db7a7fb9aa97074c5ed26623ba3bc9ff3eb3d3a1bd65954f90cc09caa263c45985a60b5f8db7111523ada3ea987d28afe7fc5051407e789

    • SSDEEP

      3072:ffdN7Ukm4khgdQHs5vfd+tOtv3AZi1z/lb5mxodrqwUPfzXYLS2xm5Hi:f104YsNFu/sB5yodewUzh2oC

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks