Overview

overview

10

Static

static

3

f98166e2a7...18.exe

windows7-x64

10

f98166e2a7...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f98166e2a74293580ade21fe5a51bf21_JaffaCakes118

  • Size

    156KB

  • Sample

    241218-ben5nsxlaj

  • MD5

    f98166e2a74293580ade21fe5a51bf21

  • SHA1

    ccedd2c63a00182794d8da557db50e985685bcfe

  • SHA256

    5e0d1f48c2afc14ec65a18430636d8e5fd0a3b3a145099d971a7a77f55fd3069

  • SHA512

    5f425b00fc722760a0491fb31867fc3c637bf41b74fcbc34109fee3ae75559afc4c263a5855262d68ab20f935df60337014b836b244e0124cd218ebad561e945

  • SSDEEP

    3072:N04SFxQrRV8tTdV/7u7nGq/D/FOfo6tFY//z57AgunAe6yhlJ:e4SkdezVju//1XV7DO6Kl

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      f98166e2a74293580ade21fe5a51bf21_JaffaCakes118

    • Size

      156KB

    • MD5

      f98166e2a74293580ade21fe5a51bf21

    • SHA1

      ccedd2c63a00182794d8da557db50e985685bcfe

    • SHA256

      5e0d1f48c2afc14ec65a18430636d8e5fd0a3b3a145099d971a7a77f55fd3069

    • SHA512

      5f425b00fc722760a0491fb31867fc3c637bf41b74fcbc34109fee3ae75559afc4c263a5855262d68ab20f935df60337014b836b244e0124cd218ebad561e945

    • SSDEEP

      3072:N04SFxQrRV8tTdV/7u7nGq/D/FOfo6tFY//z57AgunAe6yhlJ:e4SkdezVju//1XV7DO6Kl

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks