General

  • Target

    JaffaCakes118_1613319be3944ad8a491ba247988950e

  • Size

    165KB

  • Sample

    250112-xqmlwaxlhj

  • MD5

    1613319be3944ad8a491ba247988950e

  • SHA1

    f20fab2b47a47bc406262d1fe94eebbeaa3f9fea

  • SHA256

    4cd4548a746886716533c93209467c8b5e5a143b136bd690fbdd8c8eeab8559c

  • SHA512

    994d90172640d4c27326b8bc0f6531799d1a2ec03cef328df28f25b96f4389880d8ae05b3855038aed75dee0eff650865c95cc44f409468c96afa4ded37c9499

  • SSDEEP

    3072:/IfhQdQrUqok5ZEo0/75HouwFoLs53cxibWS1IZgd52P8YIv+zSZO:AfcN/eE/D5HI5sxiJIcOjhzr

Malware Config

Targets

    • Target

      JaffaCakes118_1613319be3944ad8a491ba247988950e

    • Size

      165KB

    • MD5

      1613319be3944ad8a491ba247988950e

    • SHA1

      f20fab2b47a47bc406262d1fe94eebbeaa3f9fea

    • SHA256

      4cd4548a746886716533c93209467c8b5e5a143b136bd690fbdd8c8eeab8559c

    • SHA512

      994d90172640d4c27326b8bc0f6531799d1a2ec03cef328df28f25b96f4389880d8ae05b3855038aed75dee0eff650865c95cc44f409468c96afa4ded37c9499

    • SSDEEP

      3072:/IfhQdQrUqok5ZEo0/75HouwFoLs53cxibWS1IZgd52P8YIv+zSZO:AfcN/eE/D5HI5sxiJIcOjhzr

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks