General

  • Target

    JaffaCakes118_3ace59e1019ae966e3d7e0b73ac2c8c3

  • Size

    165KB

  • Sample

    250127-bvssssvlap

  • MD5

    3ace59e1019ae966e3d7e0b73ac2c8c3

  • SHA1

    c7b87c0b515cd674aee691adbb00649cabe160d0

  • SHA256

    97e8f18076c4df6f5511015d7e6446b432d6fd3fa450d610a8ded518ebcd8a1a

  • SHA512

    4e06698fc314d1f9f14d3a01cf54a0839f9591024e721ede7f5be8dbe86c9c6f9b20b7cbcc7229a3e8e7a1989004a119d2484f1798d16ddac591dfc92640ebfd

  • SSDEEP

    3072:UUggWvei+S23U56YAdTrs9iZAR/NUgiwtavxoqrVf1yZuS5uZVLq:UUPUedSueAdTKCAR/N/Oxn9kZuS5uz

Malware Config

Targets

    • Target

      JaffaCakes118_3ace59e1019ae966e3d7e0b73ac2c8c3

    • Size

      165KB

    • MD5

      3ace59e1019ae966e3d7e0b73ac2c8c3

    • SHA1

      c7b87c0b515cd674aee691adbb00649cabe160d0

    • SHA256

      97e8f18076c4df6f5511015d7e6446b432d6fd3fa450d610a8ded518ebcd8a1a

    • SHA512

      4e06698fc314d1f9f14d3a01cf54a0839f9591024e721ede7f5be8dbe86c9c6f9b20b7cbcc7229a3e8e7a1989004a119d2484f1798d16ddac591dfc92640ebfd

    • SSDEEP

      3072:UUggWvei+S23U56YAdTrs9iZAR/NUgiwtavxoqrVf1yZuS5uZVLq:UUPUedSueAdTKCAR/N/Oxn9kZuS5uz

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

    • Cycbot family

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks