Overview

overview

10

Static

static

3

JaffaCakes...3f.exe

windows7-x64

10

JaffaCakes...3f.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_d29cadfb66e93625d051d1f52402473f

  • Size

    212KB

  • Sample

    250119-zfq8esvmdt

  • MD5

    d29cadfb66e93625d051d1f52402473f

  • SHA1

    3d0aea15516652bd28b8400ba972a85bb3a8da21

  • SHA256

    6aaf4f3b8dae877835a8d6f1535b0795eeb2758c01a26aa399c59572f05ae705

  • SHA512

    14df550fda0788b0c9e8e45c4e2ffcd1c894b91933b43e43c7feab5209a17c464a19051316482498f531cc76e61198f5318ee44442900413387ce763eb2b4f06

  • SSDEEP

    3072:zvl2flQHRveJJvrHDB0v85aPuW9fFJvsN7sAHCYoqtTnyTYqY:bWlQkH6v4aPuCvIAxo76RY

Score
10/10
cycbotbackdoordiscoveryratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_d29cadfb66e93625d051d1f52402473f

    • Size

      212KB

    • MD5

      d29cadfb66e93625d051d1f52402473f

    • SHA1

      3d0aea15516652bd28b8400ba972a85bb3a8da21

    • SHA256

      6aaf4f3b8dae877835a8d6f1535b0795eeb2758c01a26aa399c59572f05ae705

    • SHA512

      14df550fda0788b0c9e8e45c4e2ffcd1c894b91933b43e43c7feab5209a17c464a19051316482498f531cc76e61198f5318ee44442900413387ce763eb2b4f06

    • SSDEEP

      3072:zvl2flQHRveJJvrHDB0v85aPuW9fFJvsN7sAHCYoqtTnyTYqY:bWlQkH6v4aPuCvIAxo76RY

    Score
    10/10
    cycbotbackdoordiscoveryratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks