General

  • Target

    JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad

  • Size

    178KB

  • Sample

    250119-qhgmbsyndt

  • MD5

    c8cc657d5b2f5a6737635342f82ef4ad

  • SHA1

    e6acebcfc8c16c84f0a7d7b301e9aaf215f312ec

  • SHA256

    7890809eba55bba024979ed3d6705a775f8220d7963fba9c8906dafbbe7faf52

  • SHA512

    ea3abcdd0cec56f6a41178bebc9328222e28ad8d8601295d9f6ba0b21216c21061a20cca2a108552290501d28e0849cc34cb56d505251f96b4887431120cef58

  • SSDEEP

    3072:3vTe4ucH1Bva4KYN+PQWo1HSpd6/JmWgCmABVJDGYgt4gQl7d6QR:CncH1c80YYopmADJDbgOgQl7IQR

Malware Config

Targets

    • Target

      JaffaCakes118_c8cc657d5b2f5a6737635342f82ef4ad

    • Size

      178KB

    • MD5

      c8cc657d5b2f5a6737635342f82ef4ad

    • SHA1

      e6acebcfc8c16c84f0a7d7b301e9aaf215f312ec

    • SHA256

      7890809eba55bba024979ed3d6705a775f8220d7963fba9c8906dafbbe7faf52

    • SHA512

      ea3abcdd0cec56f6a41178bebc9328222e28ad8d8601295d9f6ba0b21216c21061a20cca2a108552290501d28e0849cc34cb56d505251f96b4887431120cef58

    • SSDEEP

      3072:3vTe4ucH1Bva4KYN+PQWo1HSpd6/JmWgCmABVJDGYgt4gQl7d6QR:CncH1c80YYopmADJDbgOgQl7IQR

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks