Overview

overview

10

Static

static

3

JaffaCakes...18.exe

windows7-x64

10

JaffaCakes...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218

  • Size

    158KB

  • Sample

    250103-n7m5assmfw

  • MD5

    6c7bb4113a0d58f807b5b9e4969c5218

  • SHA1

    7cbcc835ea606c8fe2bf92080a48466c573dbaa6

  • SHA256

    e2ce2ca491f48506257a74cdcfbdef4559139bd7d6e310afcec7d387ca883d92

  • SHA512

    7ac69a5962fa9c83a51481ab391961f58a411f153c6a8c6e9bed5d7ec2fe8ce37aa1dbf7b19f8e78e71dc17f05ac94434bdd86126492793104381bd162a1293e

  • SSDEEP

    3072:1BYpozFC6+q8FjGt0u2GVrbA8F8sZLc1uCuVSjcwTPAaG:1WpcFCbfu1A8Nhc1uDSjHLS

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_6c7bb4113a0d58f807b5b9e4969c5218

    • Size

      158KB

    • MD5

      6c7bb4113a0d58f807b5b9e4969c5218

    • SHA1

      7cbcc835ea606c8fe2bf92080a48466c573dbaa6

    • SHA256

      e2ce2ca491f48506257a74cdcfbdef4559139bd7d6e310afcec7d387ca883d92

    • SHA512

      7ac69a5962fa9c83a51481ab391961f58a411f153c6a8c6e9bed5d7ec2fe8ce37aa1dbf7b19f8e78e71dc17f05ac94434bdd86126492793104381bd162a1293e

    • SSDEEP

      3072:1BYpozFC6+q8FjGt0u2GVrbA8F8sZLc1uCuVSjcwTPAaG:1WpcFCbfu1A8Nhc1uDSjHLS

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks