cycbot | 36ef2dd96f997b7b8c19023f682d68052fcae410aa9bafd8f260b19237dd0af2

General

Target
jaffacakes118__376cdcce18182dedc0a12284cf1c8fb2
Size 178KB
Sample260920-ef76qa1whz
SHA256 36ef2dd96f997b7b8c19023f682d68052fcae410aa9bafd8f260b19237dd0af2
MD5 376cdcce18182dedc0a12284cf1c8fb2
SHA1 723bda8db458b176873f7f1e26c32b9ea86a3d92
SHA512 efbaf0c3bdf01edff33bdc8fdc03ae581b9e8cf52dd5ea079a4acf858a8f35539d8d7ccb618400b0f89fb4002a953beb8f89613de2f28567a52428c992c21177
SSDEEP 3072:Y6AcN1clNIcPyF2uzS64Ej9AMoJS2YSVbZL9ZNLPEJgY2hP:rpigcPW2iS640KMhWVbZL9Z+C
TLSH
T1820401BA0004A48FF4FA5832A923D674737DB6EADB808ED66A894377337411E5D167F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

C2

http://onlinebonbusson.com
http://worldsuperwater.com
http://mathematicshoolonline.com
http://ourmultstoryonline.com
http://ourlivestoryonline.com
http://testmemoryonline.com
http://vrscdxfunclub.com
http://bestmusichitonline.com
http://badcryangels.com
http://hellhappened.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

http://onlinedatingsecretfriends.com/images/im133.jpg

http://onlinedatingsecretfriends.com/images/im134.jpg

Targets

- Target
  jaffacakes118__376cdcce18182dedc0a12284cf1c8fb2
- Size 178KB
- SHA256 36ef2dd96f997b7b8c19023f682d68052fcae410aa9bafd8f260b19237dd0af2
- MD5 376cdcce18182dedc0a12284cf1c8fb2
- SHA1 723bda8db458b176873f7f1e26c32b9ea86a3d92
- SHA512 efbaf0c3bdf01edff33bdc8fdc03ae581b9e8cf52dd5ea079a4acf858a8f35539d8d7ccb618400b0f89fb4002a953beb8f89613de2f28567a52428c992c21177
- SSDEEP 3072:Y6AcN1clNIcPyF2uzS64Ej9AMoJS2YSVbZL9ZNLPEJgY2hP:rpigcPW2iS640KMhWVbZL9Z+C
- TLSH
  T1820401BA0004A48FF4FA5832A923D674737DB6EADB808ED66A894377337411E5D167F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery adware backdoor cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- Drops desktop.ini file(s)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2