Overview

overview

10

Static

static

3

f9194b7e3c...18.exe

windows7-x64

10

f9194b7e3c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9194b7e3c5e757d70512c16c6e5905c_JaffaCakes118

  • Size

    172KB

  • Sample

    241217-2fvxqa1rfm

  • MD5

    f9194b7e3c5e757d70512c16c6e5905c

  • SHA1

    6dd3fba556e8c9b9671878c137c1a437b036b685

  • SHA256

    12c681c995df3ee0ebfa932a476a813e3d76ea6c67a564b09700431eae28cc38

  • SHA512

    516fd7035937d59690a07c28fdab8748e882dc410e62c884b76782678fc7a493c7560bf327d3f3e0a28201a5a1f05d5001555765d2c2df6df71192d84bca57b7

  • SSDEEP

    3072:97p4RD9L54Gj+Zz/RKQq3niuwI0UD1U4w7ejvTYxD/PcLJWA:RS19yxVpKQ6z1U4w8TYxzH

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      f9194b7e3c5e757d70512c16c6e5905c_JaffaCakes118

    • Size

      172KB

    • MD5

      f9194b7e3c5e757d70512c16c6e5905c

    • SHA1

      6dd3fba556e8c9b9671878c137c1a437b036b685

    • SHA256

      12c681c995df3ee0ebfa932a476a813e3d76ea6c67a564b09700431eae28cc38

    • SHA512

      516fd7035937d59690a07c28fdab8748e882dc410e62c884b76782678fc7a493c7560bf327d3f3e0a28201a5a1f05d5001555765d2c2df6df71192d84bca57b7

    • SSDEEP

      3072:97p4RD9L54Gj+Zz/RKQq3niuwI0UD1U4w7ejvTYxD/PcLJWA:RS19yxVpKQ6z1U4w8TYxzH

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks