Overview

overview

10

Static

static

3

JaffaCakes...6a.exe

windows7-x64

10

JaffaCakes...6a.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_94f99c229d4850361d581b9b6ec6386a

  • Size

    201KB

  • Sample

    250117-xvb1yaznby

  • MD5

    94f99c229d4850361d581b9b6ec6386a

  • SHA1

    49d0e7d3507dd96490455f67cdc946ef260825f9

  • SHA256

    a303f53f208d52dc654f817912e352cc621e01cddb61a0c70eff3e4ea51302c6

  • SHA512

    3958668e6e652edfc23672eac765e0b0531b622d37a4d366131362508debce737c421a3495bdae0da5649125ed42bf026e23ee1a445c061b86ba1b9c4214c087

  • SSDEEP

    6144:3gdM/0j/WG536OrNDNK2UgLbjHgZ5TmD:3ge0zWQVNK27gi

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_94f99c229d4850361d581b9b6ec6386a

    • Size

      201KB

    • MD5

      94f99c229d4850361d581b9b6ec6386a

    • SHA1

      49d0e7d3507dd96490455f67cdc946ef260825f9

    • SHA256

      a303f53f208d52dc654f817912e352cc621e01cddb61a0c70eff3e4ea51302c6

    • SHA512

      3958668e6e652edfc23672eac765e0b0531b622d37a4d366131362508debce737c421a3495bdae0da5649125ed42bf026e23ee1a445c061b86ba1b9c4214c087

    • SSDEEP

      6144:3gdM/0j/WG536OrNDNK2UgLbjHgZ5TmD:3ge0zWQVNK27gi

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks