Overview

overview

10

Static

static

3

JaffaCakes...fe.exe

windows7-x64

10

JaffaCakes...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_410b528e8ce9008cf8a6fad5ae71f3fe

  • Size

    168KB

  • Sample

    250127-syxdtswkfn

  • MD5

    410b528e8ce9008cf8a6fad5ae71f3fe

  • SHA1

    a6fa111bddf7df8e3b0b093378abc21fe833cfa6

  • SHA256

    1127874ba9872cb22bbd4d5105c832fcf3901ba32a1d1529f71f1efb4f7a591c

  • SHA512

    7aebb2cfb063d89abcdeddf092222c48198d2f0b7b09a011c732d6bd2239068843919437668471973c0c7a41c3d916ad8f2a58c6ef01601bd145e36bbc311039

  • SSDEEP

    3072:U79CNiHrYE3V5Fyosw7DZl4Y8Ho5VQ+aokajZ0ZoXWjT:U79CsHrrPswPAY8SebokajuZom

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_410b528e8ce9008cf8a6fad5ae71f3fe

    • Size

      168KB

    • MD5

      410b528e8ce9008cf8a6fad5ae71f3fe

    • SHA1

      a6fa111bddf7df8e3b0b093378abc21fe833cfa6

    • SHA256

      1127874ba9872cb22bbd4d5105c832fcf3901ba32a1d1529f71f1efb4f7a591c

    • SHA512

      7aebb2cfb063d89abcdeddf092222c48198d2f0b7b09a011c732d6bd2239068843919437668471973c0c7a41c3d916ad8f2a58c6ef01601bd145e36bbc311039

    • SSDEEP

      3072:U79CNiHrYE3V5Fyosw7DZl4Y8Ho5VQ+aokajZ0ZoXWjT:U79CsHrrPswPAY8SebokajuZom

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks