Overview

overview

10

Static

static

3

JaffaCakes...8a.exe

windows7-x64

5

JaffaCakes...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9842aa1a39f83c18b9056a6fe765b78a

  • Size

    164KB

  • Sample

    250330-e5k3gszxbw

  • MD5

    9842aa1a39f83c18b9056a6fe765b78a

  • SHA1

    209a87a36be5b96f72b2288fcd8f09710cfcba49

  • SHA256

    d9da6f83ee3711995710e19f7cf9ef029ed227f9863f61b5078ac25e7339eeed

  • SHA512

    998b80a2ea6d49e18b9143692fddb940cce2af2478e6d386073c1a3676b967807f6f97bd49d8a2dcf531dc4fcde37b354c3c5aff63588208d163746bd37f7147

  • SSDEEP

    3072:tnd9nn6kAe7p6Yg58ZzMU48NSkvbJ8X46J4sm+pkKhB8t2PXQcQWrwmewJi:Nb6kAs6FCzA8NSto6wcHz87yQ

Score
10/10
cycbotbackdoordiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_9842aa1a39f83c18b9056a6fe765b78a

    • Size

      164KB

    • MD5

      9842aa1a39f83c18b9056a6fe765b78a

    • SHA1

      209a87a36be5b96f72b2288fcd8f09710cfcba49

    • SHA256

      d9da6f83ee3711995710e19f7cf9ef029ed227f9863f61b5078ac25e7339eeed

    • SHA512

      998b80a2ea6d49e18b9143692fddb940cce2af2478e6d386073c1a3676b967807f6f97bd49d8a2dcf531dc4fcde37b354c3c5aff63588208d163746bd37f7147

    • SSDEEP

      3072:tnd9nn6kAe7p6Yg58ZzMU48NSkvbJ8X46J4sm+pkKhB8t2PXQcQWrwmewJi:Nb6kAs6FCzA8NSto6wcHz87yQ

    Score
    10/10
    discoveryupxcycbotbackdoorpersistencerat

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks