General

  • Target

    JaffaCakes118_312a6c4f5763ba15b236decc331d6988

  • Size

    159KB

  • Sample

    250126-bcla1awmdv

  • MD5

    312a6c4f5763ba15b236decc331d6988

  • SHA1

    2b7ed6c89288011c05fc01437829ae4db407c2ea

  • SHA256

    38c0c533a1317ee769a557d05e93c8712b697f9020f987018c4e616521623d92

  • SHA512

    d60645a628e1f599d4cf27e1fa8fb588a059ea0e0472e864368d4e66398905f7794c162ded6900efa04f10c0b8917642380f500bb2450870688a94013a3b186c

  • SSDEEP

    3072:gFMjxQhxQiScAa2Rj9YU1LvQis4LxELX2902fJGbo3VFIe3/k/0ws:g4Khqiv0RrhQaUsbJGM3VFI+

Malware Config

Targets

    • Target

      JaffaCakes118_312a6c4f5763ba15b236decc331d6988

    • Size

      159KB

    • MD5

      312a6c4f5763ba15b236decc331d6988

    • SHA1

      2b7ed6c89288011c05fc01437829ae4db407c2ea

    • SHA256

      38c0c533a1317ee769a557d05e93c8712b697f9020f987018c4e616521623d92

    • SHA512

      d60645a628e1f599d4cf27e1fa8fb588a059ea0e0472e864368d4e66398905f7794c162ded6900efa04f10c0b8917642380f500bb2450870688a94013a3b186c

    • SSDEEP

      3072:gFMjxQhxQiScAa2Rj9YU1LvQis4LxELX2902fJGbo3VFIe3/k/0ws:g4Khqiv0RrhQaUsbJGM3VFI+

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks