Overview

overview

10

Static

static

3

JaffaCakes...d3.exe

windows7-x64

10

JaffaCakes...d3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_14c5c223f563c28c44974b440daab1d3

  • Size

    182KB

  • Sample

    250123-hszlwsyjez

  • MD5

    14c5c223f563c28c44974b440daab1d3

  • SHA1

    226e4cc01b6d5bf8e9fa68d2248cdd19e4552fa4

  • SHA256

    cdbc3dbe90cc1723a4ed36a1ea6e1721cfbcb782b08bf2b9ac3c5e58244da66d

  • SHA512

    a141fcf364e8d42acf40875e01ef8faf7f6df6ba418eb6316fe0ba752f5cd32dc442aef0715421aa5d12aee151bfb7db80e0553dea0c88e7df834be1a2b4c7e6

  • SSDEEP

    3072:CzSMe5SubW2NYWV9xfbwwy1b4hcUXgyjFRdM1478jFW2/Y:uSMraWTyMbYlLjFjM7F

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_14c5c223f563c28c44974b440daab1d3

    • Size

      182KB

    • MD5

      14c5c223f563c28c44974b440daab1d3

    • SHA1

      226e4cc01b6d5bf8e9fa68d2248cdd19e4552fa4

    • SHA256

      cdbc3dbe90cc1723a4ed36a1ea6e1721cfbcb782b08bf2b9ac3c5e58244da66d

    • SHA512

      a141fcf364e8d42acf40875e01ef8faf7f6df6ba418eb6316fe0ba752f5cd32dc442aef0715421aa5d12aee151bfb7db80e0553dea0c88e7df834be1a2b4c7e6

    • SSDEEP

      3072:CzSMe5SubW2NYWV9xfbwwy1b4hcUXgyjFRdM1478jFW2/Y:uSMraWTyMbYlLjFjM7F

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks