General

  • Target

    JaffaCakes118_1881000e125840e2f1ce8e11fd11fd79

  • Size

    167KB

  • Sample

    250112-z5vxxazkf1

  • MD5

    1881000e125840e2f1ce8e11fd11fd79

  • SHA1

    373c1710c52a49b837c916c2e5f7f9f89262ea98

  • SHA256

    4fcf450667218a1df9353065002c149c5114c3dbb1fe1c3b637e8ec6c31d7fde

  • SHA512

    789198b085b9e7e060b0bbb4879c9c61ebcca3a6777dadda43b85cc7164540ac071d25539f0db5e86e88a2805c55c8c170fa356bf6e026c2a8a8d9af183a9860

  • SSDEEP

    3072:qDcGnHuWxN1GNscDYyKGXms753/oUlX47aJfi97ynwXMI/VJZot:UfnOWLyKGXn3QkZJ479XrVJZot

Malware Config

Targets

    • Target

      JaffaCakes118_1881000e125840e2f1ce8e11fd11fd79

    • Size

      167KB

    • MD5

      1881000e125840e2f1ce8e11fd11fd79

    • SHA1

      373c1710c52a49b837c916c2e5f7f9f89262ea98

    • SHA256

      4fcf450667218a1df9353065002c149c5114c3dbb1fe1c3b637e8ec6c31d7fde

    • SHA512

      789198b085b9e7e060b0bbb4879c9c61ebcca3a6777dadda43b85cc7164540ac071d25539f0db5e86e88a2805c55c8c170fa356bf6e026c2a8a8d9af183a9860

    • SSDEEP

      3072:qDcGnHuWxN1GNscDYyKGXms753/oUlX47aJfi97ynwXMI/VJZot:UfnOWLyKGXn3QkZJ479XrVJZot

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks