General
- Target JaffaCakes118_3edc965b4753542fa2655a384ea33f27
- Size 177KB
- Sample260102-vk2shawmdl
- SHA256 bd6ab07f6e1d813d30d685f0f79dd29b95d360d869f6368a389f5f3aadca0fa7
- MD5 3edc965b4753542fa2655a384ea33f27
- SHA1 d92fabbcaf6c2c9d59873f2b22e853afada691c3
- SHA512 07fd4115ea7909ebe27ee1be447ce2f5f494bb8927a41cf1394dde86cca08f912d9eb6341f4153837f7b324f61c84c4c2ae65ea09481788c0a3f4e616cc577d1
- SSDEEP 3072:ncoA0Ej/cQqgE/c+xT50IL9EncFwQaSp0Risbd1VZqLIz50qkGDQ4Y9:caEj1qq+r0ILycF+Spkb5Zq0KVGDQ4
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3edc965b4753542fa2655a384ea33f27.exe
Resource
win10v2004-20251231-en
Malware Config
Extracted
-
cycbot
-
payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg
http://binghamtonschools.org/images/297893.jpg
http://binghamtonschools.org/images/297894.jpg
http://alleducationalsoftware.com/creditcardlogos.gif
http://alleducationalsoftware.com/creditcard.png
http://alleducationalsoftware.com/creditcard2.png
http://patentgenius.com/temp/head.png
http://patentgenius.com/132.gif
http://patentgenius.com/133.gif
http://freedownload3.com/screenshot/4/s/89_3276.gif
http://freedownload3.com/screenshot/4/s/89_3277.gif
http://freedownload3.com/screenshot/4/s/89_3278.gif
http://istockanalyst.com/png/intel.gif
http://istockanalyst.com/png/intel.jpg
http://istockanalyst.com/12.jpg
http://complaintsboard.com/complaints/logo.png
http://complaintsboard.com/complaints/zip.png
http://complaintsboard.com/complaints/rar.png
http://highspeedinternetlosangeles.webnode.com/news/1.cgi
http://highspeedinternetlosangeles.webnode.com/news/1.php
http://highspeedinternetlosangeles.webnode.com/news/2.php
http://newworldorderreport.com/favicon.ico
http://newworldorderreport.com/img/3421.png
http://newworldorderreport.com/img/3422.png
http://jointhenewworldorder.com/images/pages.jpg
http://jointhenewworldorder.com/images/pages.png
http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png
http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png
http://cdn.adventofdeception.com/logo.png
http://%s/s.php?c=121&id=%s
http://xprstats.com/images/logo.png
Targets
-
- Target JaffaCakes118_3edc965b4753542fa2655a384ea33f27
- Size 177KB
- SHA256 bd6ab07f6e1d813d30d685f0f79dd29b95d360d869f6368a389f5f3aadca0fa7
- MD5 3edc965b4753542fa2655a384ea33f27
- SHA1 d92fabbcaf6c2c9d59873f2b22e853afada691c3
- SHA512 07fd4115ea7909ebe27ee1be447ce2f5f494bb8927a41cf1394dde86cca08f912d9eb6341f4153837f7b324f61c84c4c2ae65ea09481788c0a3f4e616cc577d1
- SSDEEP 3072:ncoA0Ej/cQqgE/c+xT50IL9EncFwQaSp0Risbd1VZqLIz50qkGDQ4Y9:caEj1qq+r0ILycF+Spkb5Zq0KVGDQ4
- MD5 SHA1 SHA512 SSDEEP
Cycbot family
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.