cycbot | 369fd9fc33268793e2425ed61ce664b2a03ac151334f9f9d3be7bed52cee635a

General

Target
jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff
Size 182KB
Sample260919-sl87vssdla
SHA256 369fd9fc33268793e2425ed61ce664b2a03ac151334f9f9d3be7bed52cee635a
MD5 9b44e4440ea4d48f1e742bb051cfd6ff
SHA1 22687ec4f536a131ef462d62516691dff76a4691
SHA512 33e549f313e647b4196082c4b92910858cfdf98c5738c0874d07642c513a5df9c5dd20fee9117c2859468a5a31b578b23a6868bdd54a4d0d566a6e5dacd2e6b9
SSDEEP 3072:w7zFOI2VwG2gdTpGrP3FaFpwdXk21Om6z6shyPUNlyftzj9SdsVRK8syZWR:wfEI6lddTpGbkwBpEmgLzP+j9SdeRlZc
TLSH
T1CB04F25C5603D41AE371B4F83003E339873E24D9928A1DDB7E95B33A6B2B7B1350666D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

C2

http://worldmotoblo.com
http://resetmymemory.com
http://fastblogportal.com
http://freshmediaportal.com
http://yourimagearchive.com
http://myblogstoyou.com
http://stotre4image.com
http://allsoft4you.com
http://videocontainer.com
http://maxtroeurosys.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

http://onlinedatingsecretfriends.com/images/im133.jpg

http://onlinedatingsecretfriends.com/images/im134.jpg

Targets

- Target
  jaffacakes118__9b44e4440ea4d48f1e742bb051cfd6ff
- Size 182KB
- SHA256 369fd9fc33268793e2425ed61ce664b2a03ac151334f9f9d3be7bed52cee635a
- MD5 9b44e4440ea4d48f1e742bb051cfd6ff
- SHA1 22687ec4f536a131ef462d62516691dff76a4691
- SHA512 33e549f313e647b4196082c4b92910858cfdf98c5738c0874d07642c513a5df9c5dd20fee9117c2859468a5a31b578b23a6868bdd54a4d0d566a6e5dacd2e6b9
- SSDEEP 3072:w7zFOI2VwG2gdTpGrP3FaFpwdXk21Om6z6shyPUNlyftzj9SdsVRK8syZWR:wfEI6lddTpGbkwBpEmgLzP+j9SdeRlZc
- TLSH
  T1CB04F25C5603D41AE371B4F83003E339873E24D9928A1DDB7E95B33A6B2B7B1350666D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- Drops desktop.ini file(s)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2