cycbot | 1c01759c01166bf72094c0602274f56bcf5fe44a51d13892bc4c8a6bad542d77

General

Target
jaffacakes118_e6723522e34c0a7c27287ffd68bf71fc_JaffaCakes118
Size 278KB
Sample260915-t1ahhsfh76
SHA256 1c01759c01166bf72094c0602274f56bcf5fe44a51d13892bc4c8a6bad542d77
MD5 e6723522e34c0a7c27287ffd68bf71fc
SHA1 2ed2072fc316bec6d4cfa23b6e5fe932c8856469
SHA512 2206e770754f30dc3b97199c16ec7022c7052bf527ca28f3d1f30bcd6f1877958f0e4e7dbc1430ae42b5280934466ca89da8a27a55669bcf0f3f70a66b11716f
SSDEEP 6144:/bYJKTS3oCUI8y+tTVB9pDtF4/hWYq8KG1t4qeiiw:/XmUI8PVLpDtGwYMxi/
TLSH
T19054F17231B68809E77D9A712CC2C7709278D0F537D4A92D268AF3FE25A53943E33985
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_e6723522e34c0a7c27287ffd68bf71fc_JaffaCakes118
- Size 278KB
- SHA256 1c01759c01166bf72094c0602274f56bcf5fe44a51d13892bc4c8a6bad542d77
- MD5 e6723522e34c0a7c27287ffd68bf71fc
- SHA1 2ed2072fc316bec6d4cfa23b6e5fe932c8856469
- SHA512 2206e770754f30dc3b97199c16ec7022c7052bf527ca28f3d1f30bcd6f1877958f0e4e7dbc1430ae42b5280934466ca89da8a27a55669bcf0f3f70a66b11716f
- SSDEEP 6144:/bYJKTS3oCUI8y+tTVB9pDtF4/hWYq8KG1t4qeiiw:/XmUI8PVLpDtGwYMxi/
- TLSH
  T19054F17231B68809E77D9A712CC2C7709278D0F537D4A92D268AF3FE25A53943E33985
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery cycbot pony persistence rat spyware stealer upx adware ransomware
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Family: Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- Modifies security service
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  defense_evasion
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2