Overview

overview

10

Static

static

3

JaffaCakes...3c.exe

windows7-x64

10

JaffaCakes...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_69df22aca47809a2ff4f87b6819d0a3c

  • Size

    175KB

  • Sample

    250116-d85qma1pek

  • MD5

    69df22aca47809a2ff4f87b6819d0a3c

  • SHA1

    dbd6ef73e9011721a52ae0879966fe9e51dcdeb1

  • SHA256

    a028fbb2258686018ae123b93b96b4f6f55fd8b1937086c0b8f8d8e828330528

  • SHA512

    61d282c5c35b8ef2109c15c1377444db7327575678378eb13fcb0b8ccb84955dad844230048ea167a12526cd3a176572a4adc14cd1068f987b9b9204118ce81a

  • SSDEEP

    3072:BJUdz6ucZ48oTFUxXrG8p9ioNu1DYMRz9ucjr1M:k/cm8XTpM711M

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_69df22aca47809a2ff4f87b6819d0a3c

    • Size

      175KB

    • MD5

      69df22aca47809a2ff4f87b6819d0a3c

    • SHA1

      dbd6ef73e9011721a52ae0879966fe9e51dcdeb1

    • SHA256

      a028fbb2258686018ae123b93b96b4f6f55fd8b1937086c0b8f8d8e828330528

    • SHA512

      61d282c5c35b8ef2109c15c1377444db7327575678378eb13fcb0b8ccb84955dad844230048ea167a12526cd3a176572a4adc14cd1068f987b9b9204118ce81a

    • SSDEEP

      3072:BJUdz6ucZ48oTFUxXrG8p9ioNu1DYMRz9ucjr1M:k/cm8XTpM711M

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks