Overview

overview

10

Static

static

3

JaffaCakes...ce.exe

windows7-x64

10

JaffaCakes...ce.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4a2382be6137670d049e1832d46270ce

  • Size

    164KB

  • Sample

    250115-b8tbgswqdz

  • MD5

    4a2382be6137670d049e1832d46270ce

  • SHA1

    3d9d2e8d8fe8c3e34e3cddb30041f23accc51957

  • SHA256

    2a4f139ae32411cde4e425548e11e4a46776d293e20d00419294d1c01b99660e

  • SHA512

    84b34fd76511889b218762fce24f62c6e889f48847c43098482dcb13bf47e26db89eaf1f6b82620d74fbcc9073ca813582e6d77ce8d3f12986ef09754996388e

  • SSDEEP

    3072:3EGqYpw1b88tkrBTdCi387r4msKitgYCh+LuBwwolI56:3y1w8tQCGCr4m7H+DI5

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_4a2382be6137670d049e1832d46270ce

    • Size

      164KB

    • MD5

      4a2382be6137670d049e1832d46270ce

    • SHA1

      3d9d2e8d8fe8c3e34e3cddb30041f23accc51957

    • SHA256

      2a4f139ae32411cde4e425548e11e4a46776d293e20d00419294d1c01b99660e

    • SHA512

      84b34fd76511889b218762fce24f62c6e889f48847c43098482dcb13bf47e26db89eaf1f6b82620d74fbcc9073ca813582e6d77ce8d3f12986ef09754996388e

    • SSDEEP

      3072:3EGqYpw1b88tkrBTdCi387r4msKitgYCh+LuBwwolI56:3y1w8tQCGCr4m7H+DI5

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks