Overview

overview

10

Static

static

3

f78ed17c27...18.exe

windows7-x64

10

f78ed17c27...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118

  • Size

    173KB

  • Sample

    241216-gbv2psxrgm

  • MD5

    f78ed17c271f6ee6ec860dfddebfa271

  • SHA1

    00ac754e90a92ba8dfd76e8ec4baed8024bb84d9

  • SHA256

    be4f5e46090f5b1777e0ef23518d9e21c139bfcd4ef8f0b603658e86e6431688

  • SHA512

    40889b5d960c30f053f7e9de876179e3e813a4245f1f93f163f360eb101d3be15f811a41c81b4ebd96ddfd30432784fc3f535b2dc394faa4a9ed9ef8af71d6f3

  • SSDEEP

    3072:/CWWFMG4eW321crUVro+yCJdVSNJXA5pjX/sk6e2qZdyTQ34:TWvl12dCJdVSX8pjX/zLI

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      f78ed17c271f6ee6ec860dfddebfa271_JaffaCakes118

    • Size

      173KB

    • MD5

      f78ed17c271f6ee6ec860dfddebfa271

    • SHA1

      00ac754e90a92ba8dfd76e8ec4baed8024bb84d9

    • SHA256

      be4f5e46090f5b1777e0ef23518d9e21c139bfcd4ef8f0b603658e86e6431688

    • SHA512

      40889b5d960c30f053f7e9de876179e3e813a4245f1f93f163f360eb101d3be15f811a41c81b4ebd96ddfd30432784fc3f535b2dc394faa4a9ed9ef8af71d6f3

    • SSDEEP

      3072:/CWWFMG4eW321crUVro+yCJdVSNJXA5pjX/sk6e2qZdyTQ34:TWvl12dCJdVSX8pjX/zLI

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks