Overview

overview

10

Static

static

3

JaffaCakes...85.exe

windows7-x64

10

JaffaCakes...85.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6ae38d3574615602f890ad78523de885

  • Size

    165KB

  • Sample

    250116-e1hfsssrfm

  • MD5

    6ae38d3574615602f890ad78523de885

  • SHA1

    4051da2924b2c348b4374c1304afc943db6fae3e

  • SHA256

    4f2d4e64668992578753952bed2f88c0cc639e1a19a3a123bb6ea1a0ed51cc0d

  • SHA512

    95176b2182eeddd32b52e07e3ea17357a2de099ac51223a8b0f8dc19006e5dd3445819674f5e949a9901e546800bda301e8c047a1832c79a30885adc2f0d4e2e

  • SSDEEP

    3072:FD1mM9NIWUUXeGOTrsZdQ8NBnQn8N3s3qBAFeyQGE0foovv:11mMIieGUrATBnQntaBVGE0fp

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_6ae38d3574615602f890ad78523de885

    • Size

      165KB

    • MD5

      6ae38d3574615602f890ad78523de885

    • SHA1

      4051da2924b2c348b4374c1304afc943db6fae3e

    • SHA256

      4f2d4e64668992578753952bed2f88c0cc639e1a19a3a123bb6ea1a0ed51cc0d

    • SHA512

      95176b2182eeddd32b52e07e3ea17357a2de099ac51223a8b0f8dc19006e5dd3445819674f5e949a9901e546800bda301e8c047a1832c79a30885adc2f0d4e2e

    • SSDEEP

      3072:FD1mM9NIWUUXeGOTrsZdQ8NBnQn8N3s3qBAFeyQGE0foovv:11mMIieGUrATBnQntaBVGE0fp

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks