General
- Target jaffacakes118__395045a5984fb750eaf7b22c984a3241
- Size 178KB
- Sample260920-fjet1sscmd
- SHA256 49109695c7145bbfca76a7043d2ef7d0e1a829cd6df98e9b4197796f52081f90
- MD5 395045a5984fb750eaf7b22c984a3241
- SHA1 5d1f868e3e4c8ea0a8004e3092ada23cc82ace0b
- SHA512 b1ec1da28367b96a0b5f3f3e0bc02bccc153d25cad2c52990b367f0a1b33255380d509e699f6c8672c85a869266614a58bb8412fcdc870b17897bc7e4fdffef1
- SSDEEP 3072:v2FQVqnst3w+0ZEXteYBjqN/7s9PvRhGVcCEZstRnfSCdupVRlZgsG:v2+t3LemqN/oNvRdkXnHO
- TLSH T14704EFF50110CA5FE4FD997861A3903676AA32E6D7E20CE6CE88836B372069DDD01FD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118__395045a5984fb750eaf7b22c984a3241.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://fxsystemsone.com
-
http://killprocessoffline.com
-
http://repairshampoo.com
-
http://bigbadhead.com
-
http://freeservermonitorings.com
-
http://myonlinefreelibrarry.com
-
http://itshopsonline.com
-
http://securityshllsonline.com
-
http://laporoskopia.com
-
http://freewhoisdb.com
-
http://sslprogrammingshool.com
-
http://ddossecureonline.com
-
http://sambukaclubonline.com
-
http://hlamidioz.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118__395045a5984fb750eaf7b22c984a3241
- Size 178KB
- SHA256 49109695c7145bbfca76a7043d2ef7d0e1a829cd6df98e9b4197796f52081f90
- MD5 395045a5984fb750eaf7b22c984a3241
- SHA1 5d1f868e3e4c8ea0a8004e3092ada23cc82ace0b
- SHA512 b1ec1da28367b96a0b5f3f3e0bc02bccc153d25cad2c52990b367f0a1b33255380d509e699f6c8672c85a869266614a58bb8412fcdc870b17897bc7e4fdffef1
- SSDEEP 3072:v2FQVqnst3w+0ZEXteYBjqN/7s9PvRhGVcCEZstRnfSCdupVRlZgsG:v2+t3LemqN/oNvRdkXnHO
- TLSH T14704EFF50110CA5FE4FD997861A3903676AA32E6D7E20CE6CE88836B372069DDD01FD5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.