Overview

overview

10

Static

static

3

JaffaCakes...b5.exe

windows7-x64

5

JaffaCakes...b5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_98a3cd52a7b6c1b7dc03c9eb996288b5

  • Size

    187KB

  • Sample

    250330-n14tgazqv8

  • MD5

    98a3cd52a7b6c1b7dc03c9eb996288b5

  • SHA1

    57492c6ea0eab1a8e1ff104acfc024cfb1f142eb

  • SHA256

    0d37b18f8b97c4a6e43caaa799f6edda14d8e481c32e0fe0872e587eb0c65ec2

  • SHA512

    f62dc6b21de9f35510e4e92bcc81730921730513a32f14ebf7798d1f996cc18c1d305ca7259410a781c7edb92ce739eaf8dc19c27d2f777acae80e724363cfd5

  • SSDEEP

    3072:8Y0OQhbF1NPHP56DeKqvBSXeYhZfjnc8uuUfZuLRJHMhEy4A7Vv3kqj60/:8Yaj5vaJqvwjOhuLbMhcAB/9jr/

Score
10/10
cycbotbackdoordiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_98a3cd52a7b6c1b7dc03c9eb996288b5

    • Size

      187KB

    • MD5

      98a3cd52a7b6c1b7dc03c9eb996288b5

    • SHA1

      57492c6ea0eab1a8e1ff104acfc024cfb1f142eb

    • SHA256

      0d37b18f8b97c4a6e43caaa799f6edda14d8e481c32e0fe0872e587eb0c65ec2

    • SHA512

      f62dc6b21de9f35510e4e92bcc81730921730513a32f14ebf7798d1f996cc18c1d305ca7259410a781c7edb92ce739eaf8dc19c27d2f777acae80e724363cfd5

    • SSDEEP

      3072:8Y0OQhbF1NPHP56DeKqvBSXeYhZfjnc8uuUfZuLRJHMhEy4A7Vv3kqj60/:8Yaj5vaJqvwjOhuLbMhcAB/9jr/

    Score
    10/10
    upxcycbotbackdoordiscoverypersistencerat

    • Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • Cycbot family

      cycbot

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks