General

  • Target

    4c102f72cf215c188ed4000a47eb09e8edf82c054a36e0eb3d95093f2adba2e1N.exe

  • Size

    174KB

  • Sample

    250124-hbqmnavle1

  • MD5

    f3b5c71429882508a16b171bfd6e3d50

  • SHA1

    5ba90d177031465c2b8d9f94090884d882ec3d17

  • SHA256

    4c102f72cf215c188ed4000a47eb09e8edf82c054a36e0eb3d95093f2adba2e1

  • SHA512

    d9a64d326b031cc3f400b7134bc39a2d99f57a7590fdcbcc5be794b95b2554947a6d527e4d25540e945a3480fee853e533018b6d51d7d3a0f795f44d587c6073

  • SSDEEP

    3072:2vW+2IUadlM4GD8hzSyM6kb5G1zIRObix0AoMBiOKoYkEI52Ap+hlmlzeHh4/T8I:2vW+Br6epkb5G1MRN0cBiroYI2Qlzb8I

Malware Config

Targets

    • Target

      4c102f72cf215c188ed4000a47eb09e8edf82c054a36e0eb3d95093f2adba2e1N.exe

    • Size

      174KB

    • MD5

      f3b5c71429882508a16b171bfd6e3d50

    • SHA1

      5ba90d177031465c2b8d9f94090884d882ec3d17

    • SHA256

      4c102f72cf215c188ed4000a47eb09e8edf82c054a36e0eb3d95093f2adba2e1

    • SHA512

      d9a64d326b031cc3f400b7134bc39a2d99f57a7590fdcbcc5be794b95b2554947a6d527e4d25540e945a3480fee853e533018b6d51d7d3a0f795f44d587c6073

    • SSDEEP

      3072:2vW+2IUadlM4GD8hzSyM6kb5G1zIRObix0AoMBiOKoYkEI52Ap+hlmlzeHh4/T8I:2vW+Br6epkb5G1MRN0cBiroYI2Qlzb8I

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks