Overview

overview

10

Static

static

3

JaffaCakes...ea.exe

windows7-x64

10

JaffaCakes...ea.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_723a3f6cf905602f9a3a18a21f67e6ea

  • Size

    164KB

  • Sample

    250201-qr83yatpgv

  • MD5

    723a3f6cf905602f9a3a18a21f67e6ea

  • SHA1

    66483f1d55d28272e8c9fb46026a9915cd44e766

  • SHA256

    c3cfba31dca1199fb0b2c5a3c8322335c7e3370dcc112298981509dc6ae17def

  • SHA512

    8382bfdb6e7a31f1e6fecd0a6ae82395c604d329240110b8b22265127f3871f80f688954191be1959f968a2de4d73e7adec08e661c1c30a6098c23b70cd61553

  • SSDEEP

    3072:x6NrWISWp5i31KlZLQh89owVMUNPUsB6hYx6gXvKsCjQ+GjszNM:vWp5kqjrRNc5evKsCjN5N

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_723a3f6cf905602f9a3a18a21f67e6ea

    • Size

      164KB

    • MD5

      723a3f6cf905602f9a3a18a21f67e6ea

    • SHA1

      66483f1d55d28272e8c9fb46026a9915cd44e766

    • SHA256

      c3cfba31dca1199fb0b2c5a3c8322335c7e3370dcc112298981509dc6ae17def

    • SHA512

      8382bfdb6e7a31f1e6fecd0a6ae82395c604d329240110b8b22265127f3871f80f688954191be1959f968a2de4d73e7adec08e661c1c30a6098c23b70cd61553

    • SSDEEP

      3072:x6NrWISWp5i31KlZLQh89owVMUNPUsB6hYx6gXvKsCjQ+GjszNM:vWp5kqjrRNc5evKsCjN5N

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks