Overview

overview

10

Static

static

3

JaffaCakes...72.exe

windows7-x64

10

JaffaCakes...72.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_729d080c3ddc3a37e235f3ca0dc08a72

  • Size

    204KB

  • Sample

    250201-rk197avrhs

  • MD5

    729d080c3ddc3a37e235f3ca0dc08a72

  • SHA1

    63c572b8e395ced7134e6921c407fa9555251f5e

  • SHA256

    f9c31819a9bc8904df5753e8eff02e66d95110ecc1aa97f3b437809ad7ec5c64

  • SHA512

    c63bb1f1d03498022420a5fa8967a75393d7a7abe1944d86942574be7e0e107723915f458b9ea175de7079187f0f6bab6efeca809609b045c4d8144ca016271a

  • SSDEEP

    6144:kvDj+Vgh3mhV8yMQ7/z9r8S3RXvO8NdhQ8Wk7fjT3zdq:k7j+vhV8yMYr/3De8JjT3pq

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_729d080c3ddc3a37e235f3ca0dc08a72

    • Size

      204KB

    • MD5

      729d080c3ddc3a37e235f3ca0dc08a72

    • SHA1

      63c572b8e395ced7134e6921c407fa9555251f5e

    • SHA256

      f9c31819a9bc8904df5753e8eff02e66d95110ecc1aa97f3b437809ad7ec5c64

    • SHA512

      c63bb1f1d03498022420a5fa8967a75393d7a7abe1944d86942574be7e0e107723915f458b9ea175de7079187f0f6bab6efeca809609b045c4d8144ca016271a

    • SSDEEP

      6144:kvDj+Vgh3mhV8yMQ7/z9r8S3RXvO8NdhQ8Wk7fjT3zdq:k7j+vhV8yMYr/3De8JjT3pq

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks