Overview

overview

10

Static

static

3

JaffaCakes...80.exe

windows7-x64

10

JaffaCakes...80.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_832fe98ca30a2d3b552d7d54b5054780

  • Size

    159KB

  • Sample

    250116-12jadaslaj

  • MD5

    832fe98ca30a2d3b552d7d54b5054780

  • SHA1

    d33c21ff4710274a7cd89c66ffbfd5b10e22326b

  • SHA256

    69609f8b310cd2d655cf3ced4ca97edd60e8f489d1d79dc471eac96a9b6ddfe7

  • SHA512

    e333fbb70f5db4f1bac2d3020bcd43cd0dd4b5f12a603c867c53db115fad9ac1e04b7eaf5ca330f688f703c5c06d40f336992f2de851d1bc0690131b630c6f7b

  • SSDEEP

    3072:2Lyeymq4e1DR44OH3x15jitcDiOD7bGXHKDngzP4ma20V4d:VeA4sDQ3x13rOHKLgzP4ma20C

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_832fe98ca30a2d3b552d7d54b5054780

    • Size

      159KB

    • MD5

      832fe98ca30a2d3b552d7d54b5054780

    • SHA1

      d33c21ff4710274a7cd89c66ffbfd5b10e22326b

    • SHA256

      69609f8b310cd2d655cf3ced4ca97edd60e8f489d1d79dc471eac96a9b6ddfe7

    • SHA512

      e333fbb70f5db4f1bac2d3020bcd43cd0dd4b5f12a603c867c53db115fad9ac1e04b7eaf5ca330f688f703c5c06d40f336992f2de851d1bc0690131b630c6f7b

    • SSDEEP

      3072:2Lyeymq4e1DR44OH3x15jitcDiOD7bGXHKDngzP4ma20V4d:VeA4sDQ3x13rOHKLgzP4ma20C

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks