Overview

overview

10

Static

static

3

JaffaCakes...90.exe

windows7-x64

10

JaffaCakes...90.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5899eef841439556bf75d8106a83cf90

  • Size

    192KB

  • Sample

    250115-q37z1swkgp

  • MD5

    5899eef841439556bf75d8106a83cf90

  • SHA1

    3c57d2905cec62892ca2ec65e8f372086eba060f

  • SHA256

    4ef647df7ff0674d27ebfd54db705d2798273811e6edb01099adba78da9dc073

  • SHA512

    3d2576ddd3290fde343957f6955d504d66e1629d6c0904ab36e5ad2f6eec034488f6994fa1cac01e6933dc52b7935c792691770c2e9bd37cac54d8f20bf5b355

  • SSDEEP

    3072:a8OdmJnR4rL7GLL3mPSCnuq4SooYd6+s3VrHwjgAjze+9DpL:+dcnR46f3mqCYSoL6+segD+9Dp

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_5899eef841439556bf75d8106a83cf90

    • Size

      192KB

    • MD5

      5899eef841439556bf75d8106a83cf90

    • SHA1

      3c57d2905cec62892ca2ec65e8f372086eba060f

    • SHA256

      4ef647df7ff0674d27ebfd54db705d2798273811e6edb01099adba78da9dc073

    • SHA512

      3d2576ddd3290fde343957f6955d504d66e1629d6c0904ab36e5ad2f6eec034488f6994fa1cac01e6933dc52b7935c792691770c2e9bd37cac54d8f20bf5b355

    • SSDEEP

      3072:a8OdmJnR4rL7GLL3mPSCnuq4SooYd6+s3VrHwjgAjze+9DpL:+dcnR46f3mqCYSoL6+segD+9Dp

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks