General
- Target jaffacakes118__2d08a711035f3c2367949e662b6fe7ed
- Size 190KB
- Sample260919-17dbbacb75
- SHA256 d94fa09227e15235190b4332083195a8b464370ba3c5147ee977dd5734502755
- MD5 2d08a711035f3c2367949e662b6fe7ed
- SHA1 389ceb4821aaa41214b30ee551274ae4f78d70ad
- SHA512 a2c0b7b9f5fbcd3d6f456b954e5d93cf50944dd1c2b25aedde0ad9963800122e3291ccbe47b7079036d72ff89c8bfd45faab46bad676c2db95221f6dece7362f
- SSDEEP 3072:7xUEPQzR7FHLdKc1cy0Qdrnrdfubd+6c8BT6GuC7nK5D+5F:dUEozzHLPc3GrdGfJBT6wbF
- TLSH T19E14F1FA1420D62BF4F8943A50D7C632F76C664AD2901CE1AE5447F82BB578CCC52FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118__2d08a711035f3c2367949e662b6fe7ed.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://maildbaccess.com
-
http://mediadryvers.com
-
http://kinderjoys.com
-
http://milkiwals.com
-
http://ourrepolists.com
-
http://torrentclist.com
-
http://ourhelpsme.com
-
http://snikersonline.com
-
http://laporoskopia.com
-
http://freewhoisdb.com
-
http://sslprogrammingshool.com
-
http://ddossecureonline.com
-
http://sambukaclubonline.com
-
http://hlamidioz.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118__2d08a711035f3c2367949e662b6fe7ed
- Size 190KB
- SHA256 d94fa09227e15235190b4332083195a8b464370ba3c5147ee977dd5734502755
- MD5 2d08a711035f3c2367949e662b6fe7ed
- SHA1 389ceb4821aaa41214b30ee551274ae4f78d70ad
- SHA512 a2c0b7b9f5fbcd3d6f456b954e5d93cf50944dd1c2b25aedde0ad9963800122e3291ccbe47b7079036d72ff89c8bfd45faab46bad676c2db95221f6dece7362f
- SSDEEP 3072:7xUEPQzR7FHLdKc1cy0Qdrnrdfubd+6c8BT6GuC7nK5D+5F:dUEozzHLPc3GrdGfJBT6wbF
- TLSH T19E14F1FA1420D62BF4F8943A50D7C632F76C664AD2901CE1AE5447F82BB578CCC52FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.