General
- Target JaffaCakes118_30f81cf9147a741cb2a509b991e52643
- Size 170KB
- Sample251024-xqyn5sbw2f
- SHA256 e46a467fb47a2a044d7588f93a4cd8b6bb1083574044e903b69be5eda4054a9d
- MD5 30f81cf9147a741cb2a509b991e52643
- SHA1 a404c8f8741e548734b7a9669a9cdd24892008fc
- SHA512 e22f43ddf175b3a6c3cbf944619536f49688d2bc27b3ef9c6e5a1115470837ccd8040b529f552bc87c35f05c2c7af4a79fed9d05fbd5b05bbbe52f1f746775c9
- SSDEEP 3072:nSqmDtbBl4mHZahYTZKv3sZCbZKFYQ8L0vB+P/rq1dbxt5kQ:nbSLBHZahcZKkyKFYhLuxxt5kQ
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_30f81cf9147a741cb2a509b991e52643.exe
Resource
win10v2004-20251016-en
Malware Config
Extracted
-
cycbot
-
http://worldorderlive.com
-
http://rumperstumprs.com
-
http://transaerosystems.com
-
http://freeridershools.com
-
http://ourbigdrophills.com
-
http://mydbonlineaccess.com
-
http://onlinepdahelpforyou.com
-
http://remarkreddomas.com
-
http://transfersakkonline.com
-
http://backupdomaintolevel.com
-
payload_url
http://armoredlegion.com/305986.png
http://armoredlegion.com/16354.png
http://armoredlegion.com/716354_m61.png
http://mektek.net/thelab/wiley.jpg
http://knowledgesutra.com/img/temp/hi.cgi
http://knowledgesutra.com/img/temp/head.png
http://battleon.com/134.gif
http://battleon.com/132.gif
http://battleon.com/133.gif
http://browsermmorpg.com/images/cpc.png
http://browsermmorpg.com/images/cpc2.png
http://browsermmorpg.com/img/intel.gif
http://browsermmorpg.com/img/intel.jpg
http://012webpages.com/christian12.jpg
http://012webpages.com/christian13.jpg
http://012webpages.com/christian14.jpg
http://tri-countymech.com/g/livechat.png
http://tri-countymech.com/g/logo.png
http://tri-countymech.com/g/133.jpg
http://tri-countymech.com/g/134.jpg
http://electronicstheory.com/pics/valley.png
http://electronicstheory.com/pics/sun.png
http://classicbattletech.com/lhous3.gif
http://classicbattletech.com/lhous4.gif
http://classicbattletech.com/lhous5.gif
http://classicbattletech.com/lhous6.gif
http://engineeringcrossing.com/images/misc/23525.png
http://engineeringcrossing.com/images/misc/64646.png
http://xprstats.com/images/logo.png
http://%s/s.php?c=121&id=%s
Targets
-
- Target JaffaCakes118_30f81cf9147a741cb2a509b991e52643
- Size 170KB
- SHA256 e46a467fb47a2a044d7588f93a4cd8b6bb1083574044e903b69be5eda4054a9d
- MD5 30f81cf9147a741cb2a509b991e52643
- SHA1 a404c8f8741e548734b7a9669a9cdd24892008fc
- SHA512 e22f43ddf175b3a6c3cbf944619536f49688d2bc27b3ef9c6e5a1115470837ccd8040b529f552bc87c35f05c2c7af4a79fed9d05fbd5b05bbbe52f1f746775c9
- SSDEEP 3072:nSqmDtbBl4mHZahYTZKv3sZCbZKFYQ8L0vB+P/rq1dbxt5kQ:nbSLBHZahcZKkyKFYhLuxxt5kQ
- MD5 SHA1 SHA512 SSDEEP
-
Cycbot family
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
Modifies WinLogon for persistence