Overview

overview

10

Static

static

3

JaffaCakes...15.exe

windows7-x64

10

JaffaCakes...15.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b761729a6e9d43f8536520b3c6123215

  • Size

    173KB

  • Sample

    250118-3h5elsykbt

  • MD5

    b761729a6e9d43f8536520b3c6123215

  • SHA1

    dec925319beba90293c6d69dff12cc8b1ec9a0af

  • SHA256

    7d5225a6e3e427e897554049dc19d7bb75cc66dc331f81e89a5a7c918be24f09

  • SHA512

    b516fe660ffa144674dabf3290bf26973efe464ca8f7e18328c8258f308770ca4905e2da38017a0272c6b8dbb0cfa0ae929ed6d14b181d91af2c262a1941613d

  • SSDEEP

    3072:/RGczuwKVTC+ntw5Xor5qju2rlAp0qr9:/RG7VTCea5Xg5qjuCAN

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_b761729a6e9d43f8536520b3c6123215

    • Size

      173KB

    • MD5

      b761729a6e9d43f8536520b3c6123215

    • SHA1

      dec925319beba90293c6d69dff12cc8b1ec9a0af

    • SHA256

      7d5225a6e3e427e897554049dc19d7bb75cc66dc331f81e89a5a7c918be24f09

    • SHA512

      b516fe660ffa144674dabf3290bf26973efe464ca8f7e18328c8258f308770ca4905e2da38017a0272c6b8dbb0cfa0ae929ed6d14b181d91af2c262a1941613d

    • SSDEEP

      3072:/RGczuwKVTC+ntw5Xor5qju2rlAp0qr9:/RG7VTCea5Xg5qjuCAN

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks