Overview

overview

10

Static

static

3

JaffaCakes...f0.exe

windows7-x64

10

JaffaCakes...f0.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_741585b050760070c160f80d47e0b6f0

  • Size

    193KB

  • Sample

    250201-vrf5datpfp

  • MD5

    741585b050760070c160f80d47e0b6f0

  • SHA1

    7a2676889475dec113f787fd6376a60653a54948

  • SHA256

    e7b997ad7f409b43c71bbc7882189ec4ba8d09fe1d58c3e5c60526891efd50b8

  • SHA512

    5c18111a2444a938ede2113f7251ecc689e478ed9b8d845c2c949e15e2bcb2fe83960082af30edae3dbba4302a8cadcd8b7da0fc8f7898473f2dd6e58d8d5ac9

  • SSDEEP

    6144:Qkrv2dIUxHqmt0ZJh1pINcqJpfJNTF8oq:Qav2dRHmJhufpfJNTFRq

Score
10/10
cycbotbackdoordiscoverypersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_741585b050760070c160f80d47e0b6f0

    • Size

      193KB

    • MD5

      741585b050760070c160f80d47e0b6f0

    • SHA1

      7a2676889475dec113f787fd6376a60653a54948

    • SHA256

      e7b997ad7f409b43c71bbc7882189ec4ba8d09fe1d58c3e5c60526891efd50b8

    • SHA512

      5c18111a2444a938ede2113f7251ecc689e478ed9b8d845c2c949e15e2bcb2fe83960082af30edae3dbba4302a8cadcd8b7da0fc8f7898473f2dd6e58d8d5ac9

    • SSDEEP

      6144:Qkrv2dIUxHqmt0ZJh1pINcqJpfJNTF8oq:Qav2dRHmJhufpfJNTFRq

    Score
    10/10
    cycbotbackdoordiscoverypersistenceratspywarestealerupx

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks