Overview

overview

10

Static

static

3

JaffaCakes...3e.exe

windows7-x64

10

JaffaCakes...3e.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_23c859f5acb3b76c711f5289dcaf4d3e

  • Size

    167KB

  • Sample

    250113-hqwr8atngn

  • MD5

    23c859f5acb3b76c711f5289dcaf4d3e

  • SHA1

    399d44ea531a2c196d31fcb4b67fdcfcc23868bb

  • SHA256

    141bfdda42fd34835f3bf336b1c47d485260b716d7edba01fb6ce957dce3bd6e

  • SHA512

    57c11bade69926e183b9bca11f27fc886dc098b31dd737028e41e37d953720b7ecfcb934e9363d0c724a2d52c92aa3924bd09b6a9db054b7dec7ed359c377173

  • SSDEEP

    3072:9TG6TWmatlxf6ZbvKI8hxfX3A4uPvjrNbF7DoN18GJ8gp:9TjTja38Z2I8hxfnA3XjrNb9owG+g

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_23c859f5acb3b76c711f5289dcaf4d3e

    • Size

      167KB

    • MD5

      23c859f5acb3b76c711f5289dcaf4d3e

    • SHA1

      399d44ea531a2c196d31fcb4b67fdcfcc23868bb

    • SHA256

      141bfdda42fd34835f3bf336b1c47d485260b716d7edba01fb6ce957dce3bd6e

    • SHA512

      57c11bade69926e183b9bca11f27fc886dc098b31dd737028e41e37d953720b7ecfcb934e9363d0c724a2d52c92aa3924bd09b6a9db054b7dec7ed359c377173

    • SSDEEP

      3072:9TG6TWmatlxf6ZbvKI8hxfX3A4uPvjrNbF7DoN18GJ8gp:9TjTja38Z2I8hxfnA3XjrNb9owG+g

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks