Overview

overview

10

Static

static

3

JaffaCakes...93.exe

windows7-x64

10

JaffaCakes...93.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_73534d26ab40ee356ec097a7b04e5f93

  • Size

    199KB

  • Sample

    250201-s5cb8symcy

  • MD5

    73534d26ab40ee356ec097a7b04e5f93

  • SHA1

    33f1322c9cd474ae8cde7873418597ef58d036dc

  • SHA256

    f56c042448a70e86c30519d880cbd0701ecf19968c32529bbb3fe3ac0b8a85da

  • SHA512

    9ece9a0c2b7662be956ea94a21693f9963ddf27d949494d00c3edfa3ea3120097cbc14034019fc006e09ebbdc94e2125715762ee3856fe11448ae444c3811d76

  • SSDEEP

    6144:wm2ucc2DmJq3jCEi5ojBZNoYsZazj0tsl:waV2DoeViujdofa8Wl

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_73534d26ab40ee356ec097a7b04e5f93

    • Size

      199KB

    • MD5

      73534d26ab40ee356ec097a7b04e5f93

    • SHA1

      33f1322c9cd474ae8cde7873418597ef58d036dc

    • SHA256

      f56c042448a70e86c30519d880cbd0701ecf19968c32529bbb3fe3ac0b8a85da

    • SHA512

      9ece9a0c2b7662be956ea94a21693f9963ddf27d949494d00c3edfa3ea3120097cbc14034019fc006e09ebbdc94e2125715762ee3856fe11448ae444c3811d76

    • SSDEEP

      6144:wm2ucc2DmJq3jCEi5ojBZNoYsZazj0tsl:waV2DoeViujdofa8Wl

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Modifies WinLogon for persistence

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks