Overview

overview

10

Static

static

3

JaffaCakes...8f.exe

windows7-x64

10

JaffaCakes...8f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_40d23ad31113c3dafceae457e06e588f

  • Size

    169KB

  • Sample

    250114-vdwb5svrej

  • MD5

    40d23ad31113c3dafceae457e06e588f

  • SHA1

    e9b3923841644651ba1be244ebc48d69b8919705

  • SHA256

    26b320bcb4429f4d44ce8e33b4edbcb5d101a85e1d29e7bac6474d4f87efddb7

  • SHA512

    4cc2e60857a71da6e78f02e0a51e9834dfc3a55768b2dd4d1f6134b8496111d21d9a0d81e94c4a1efccd9896e78d1531bdc53338eedc7bd5e699ec5f2d27234c

  • SSDEEP

    3072:e+DbiQtoothjeaulaGO0+hoNXsJiCnwWkUQ1k4TG5bxowNH6/LS89Av/gknJ:9OnK1eaurowXWi6Vkt1k4qx21/L59e46

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_40d23ad31113c3dafceae457e06e588f

    • Size

      169KB

    • MD5

      40d23ad31113c3dafceae457e06e588f

    • SHA1

      e9b3923841644651ba1be244ebc48d69b8919705

    • SHA256

      26b320bcb4429f4d44ce8e33b4edbcb5d101a85e1d29e7bac6474d4f87efddb7

    • SHA512

      4cc2e60857a71da6e78f02e0a51e9834dfc3a55768b2dd4d1f6134b8496111d21d9a0d81e94c4a1efccd9896e78d1531bdc53338eedc7bd5e699ec5f2d27234c

    • SSDEEP

      3072:e+DbiQtoothjeaulaGO0+hoNXsJiCnwWkUQ1k4TG5bxowNH6/LS89Av/gknJ:9OnK1eaurowXWi6Vkt1k4qx21/L59e46

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks