Overview

overview

10

Static

static

3

JaffaCakes...ca.exe

windows7-x64

10

JaffaCakes...ca.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7735855acf95a20be81302c8867ed6ca

  • Size

    179KB

  • Sample

    250104-dftsnaznbq

  • MD5

    7735855acf95a20be81302c8867ed6ca

  • SHA1

    e1aed269a95936936914238fe2f923c0e0894d02

  • SHA256

    9e9cc54cc7db0037d641d1496ea2021b248ad829b7c19484886eba8c3d15d6f2

  • SHA512

    0660a122ebab89bfd1d975a74e34b7456e0397c8306dfefe74069bd1c3ca1c8c613a842adf131464c14f216d46eb0df3bb71c5b491e65e94d1dff74d9e69c8ea

  • SSDEEP

    3072:6uTbE585+kWQKhRPZeBx+IG1jaFjPy7D6lC2YGvrFB5nXIADu:6Sc8wRzhaxK7D6LrFBNh

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_7735855acf95a20be81302c8867ed6ca

    • Size

      179KB

    • MD5

      7735855acf95a20be81302c8867ed6ca

    • SHA1

      e1aed269a95936936914238fe2f923c0e0894d02

    • SHA256

      9e9cc54cc7db0037d641d1496ea2021b248ad829b7c19484886eba8c3d15d6f2

    • SHA512

      0660a122ebab89bfd1d975a74e34b7456e0397c8306dfefe74069bd1c3ca1c8c613a842adf131464c14f216d46eb0df3bb71c5b491e65e94d1dff74d9e69c8ea

    • SSDEEP

      3072:6uTbE585+kWQKhRPZeBx+IG1jaFjPy7D6lC2YGvrFB5nXIADu:6Sc8wRzhaxK7D6LrFBNh

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks