Overview

overview

10

Static

static

3

fa13215c8b...18.exe

windows7-x64

10

fa13215c8b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa13215c8ba0ad19e145e3ded304594d_JaffaCakes118

  • Size

    166KB

  • Sample

    241218-eyy1rstrel

  • MD5

    fa13215c8ba0ad19e145e3ded304594d

  • SHA1

    f32ade890782f003a92b3ddcfb5c7301dfde85dd

  • SHA256

    59d1a2def07c6d5cbf67773e9d9827d0fabe0e35d3cdd7e2ec30c400eb960d47

  • SHA512

    6f25d3660894a919a8fe3540a4d7caaa1c0c8bf452dc203b111ff0e1fa249f9930a404bc6910a5483d3946b15aac53825d536d8a653800d69121de0a0f2f423c

  • SSDEEP

    3072:Yhi/4AH4OZb3GWaef4Sc+ahiagxu2RkGUzu3jOEHNv02+a8lrhN+RF:ei/7zIe3agjHScv+aEE

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      fa13215c8ba0ad19e145e3ded304594d_JaffaCakes118

    • Size

      166KB

    • MD5

      fa13215c8ba0ad19e145e3ded304594d

    • SHA1

      f32ade890782f003a92b3ddcfb5c7301dfde85dd

    • SHA256

      59d1a2def07c6d5cbf67773e9d9827d0fabe0e35d3cdd7e2ec30c400eb960d47

    • SHA512

      6f25d3660894a919a8fe3540a4d7caaa1c0c8bf452dc203b111ff0e1fa249f9930a404bc6910a5483d3946b15aac53825d536d8a653800d69121de0a0f2f423c

    • SSDEEP

      3072:Yhi/4AH4OZb3GWaef4Sc+ahiagxu2RkGUzu3jOEHNv02+a8lrhN+RF:ei/7zIe3agjHScv+aEE

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks