cycbot | 25d0017301cd8252f6e6e499c0df1f9790df64fea1c64c8a2ce4ee652b093493 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...be.exe

windows7-x64

JaffaCakes...be.exe

windows10-2004-x64

3

Sharing

General

Target

JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe
Size

163KB
Sample

250104-bvs4kawmgr
MD5

76cf655b9fc28c1fead90e6b2c8b3dbe
SHA1

364216d15a6f324fc13492f42522ed0ccc82cc75
SHA256

25d0017301cd8252f6e6e499c0df1f9790df64fea1c64c8a2ce4ee652b093493
SHA512

2454babc1ce757c655347a851210f38332c9d99efe947795ca045c6bda8c740e2e4cce23ff7813488aa8e862ad09f018fed6e23744b8a6eae22f76033d1f6be4
SSDEEP

3072:qIPkh4BR3Bw560TgT4reY/gjCYCiwVPiR40IXjLP7Yp6j3nKAxfTATuc832i15LN:qth4H3BwA0G4rP4tCiwcTIXLXbiE3VLW

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe

Resource

win7-20240903-en

cycbot backdoor discovery persistence rat spyware stealer upx

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe
- Size
  
  163KB
- MD5
  
  76cf655b9fc28c1fead90e6b2c8b3dbe
- SHA1
  
  364216d15a6f324fc13492f42522ed0ccc82cc75
- SHA256
  
  25d0017301cd8252f6e6e499c0df1f9790df64fea1c64c8a2ce4ee652b093493
- SHA512
  
  2454babc1ce757c655347a851210f38332c9d99efe947795ca045c6bda8c740e2e4cce23ff7813488aa8e862ad09f018fed6e23744b8a6eae22f76033d1f6be4
- SSDEEP
  
  3072:qIPkh4BR3Bw560TgT4reY/gjCYCiwVPiR40IXjLP7Yp6j3nKAxfTATuc832i15LN:qth4H3BwA0G4rP4tCiwcTIXLXbiE3VLW
Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx
- Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Cycbot family
  cycbot
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

cycbotbackdoordiscoverypersistenceratspywarestealerupx

behavioral2

© 2018-2025

Terms | Privacy