Overview

overview

10

Static

static

3

f83d393ede...18.exe

windows7-x64

10

f83d393ede...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f83d393ededf2766adf11b8e51015a33_JaffaCakes118

  • Size

    168KB

  • Sample

    241216-ksmcnstphr

  • MD5

    f83d393ededf2766adf11b8e51015a33

  • SHA1

    ff07e287c98c842ed42e0fbaf8147d3f23f06a6a

  • SHA256

    8df096d7ac5fbbf87d5f117c370590f0f177f5963e873171451af1a5674ce521

  • SHA512

    70a4bd41aa05c53b44c439d5f6c9fa58425a23b520915bc5a2ba7b74e899d199fa5a915f12c95b4321477f8bc66e1745ca955f5bc17207e243184e8d0fe7397e

  • SSDEEP

    3072:k02RCXtj4OB2EEkxjtiLz00T1pOYvcEr4SF6Evm3b2syXxAP:n2QdR2qxjtiX00hcE5xvUHyhK

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      f83d393ededf2766adf11b8e51015a33_JaffaCakes118

    • Size

      168KB

    • MD5

      f83d393ededf2766adf11b8e51015a33

    • SHA1

      ff07e287c98c842ed42e0fbaf8147d3f23f06a6a

    • SHA256

      8df096d7ac5fbbf87d5f117c370590f0f177f5963e873171451af1a5674ce521

    • SHA512

      70a4bd41aa05c53b44c439d5f6c9fa58425a23b520915bc5a2ba7b74e899d199fa5a915f12c95b4321477f8bc66e1745ca955f5bc17207e243184e8d0fe7397e

    • SSDEEP

      3072:k02RCXtj4OB2EEkxjtiLz00T1pOYvcEr4SF6Evm3b2syXxAP:n2QdR2qxjtiX00hcE5xvUHyhK

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks