General

  • Target

    JaffaCakes118_31a1d77061d5aead3dd3c0831ef43689

  • Size

    197KB

  • Sample

    250126-cmm31sxrft

  • MD5

    31a1d77061d5aead3dd3c0831ef43689

  • SHA1

    f05b2ca574a00c843d2319e255fd4545b3366562

  • SHA256

    1383b00e223f3e560894307cdfa57205dfa62ac7e155ddc08990b0446d59ea19

  • SHA512

    605398bb769a7f0994a7ac6be99204f29073663829868a0f5cace7065eb667b1a33abd74762c62748ecbf381388c4fd3f7d8bec320311d555b90ec0f0e949cc2

  • SSDEEP

    3072:8SMgm67GU+5mNR1+E2tmVprtnzc2jREcUrgpTcEZW/q4evRlOEAh3:8SMgm8j+o1vtzjREvrgpFZWC4AxA

Malware Config

Targets

    • Target

      JaffaCakes118_31a1d77061d5aead3dd3c0831ef43689

    • Size

      197KB

    • MD5

      31a1d77061d5aead3dd3c0831ef43689

    • SHA1

      f05b2ca574a00c843d2319e255fd4545b3366562

    • SHA256

      1383b00e223f3e560894307cdfa57205dfa62ac7e155ddc08990b0446d59ea19

    • SHA512

      605398bb769a7f0994a7ac6be99204f29073663829868a0f5cace7065eb667b1a33abd74762c62748ecbf381388c4fd3f7d8bec320311d555b90ec0f0e949cc2

    • SSDEEP

      3072:8SMgm67GU+5mNR1+E2tmVprtnzc2jREcUrgpTcEZW/q4evRlOEAh3:8SMgm8j+o1vtzjREvrgpFZWC4AxA

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks