cycbot | fc49c0de0109c60ffcc2f9218e6c9f92d3ed5f089bdfe5b186caec0163a654e5

General

Target
jaffacakes118__4002e1b18c94bb78ca1095bf3c73263f
Size 187KB
Sample260920-j49rnstsgs
SHA256 fc49c0de0109c60ffcc2f9218e6c9f92d3ed5f089bdfe5b186caec0163a654e5
MD5 4002e1b18c94bb78ca1095bf3c73263f
SHA1 07e710c6f2f7a24666c6b7a59d2bd867cd1420ee
SHA512 26ddf9a4361ef38f2bd62c2b509aade4fc45cd5c96a2c8b1e884ba33187ef887976c9800a166029f54bd6a1eff87c2c3b4a533c11c365eb6a5380dae286f600e
SSDEEP 3072:jc/NAm/PF74riKg+K28FEJmCWSaMTxotw5JvfEhlXgTrV04mGhXzVUnW:j6NHabK28tCiMTxZJ3iXgy49hXiW
TLSH
T19714F1F1B8A58857E0FA843424978435F26666DAD3906CD6DE98833E2B5438CDC16FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

C2

http://fxsystemsone.com
http://killprocessoffline.com
http://repairshampoo.com
http://bigbadhead.com
http://freeservermonitorings.com
http://myonlinefreelibrarry.com
http://itshopsonline.com
http://securityshllsonline.com
http://laporoskopia.com
http://freewhoisdb.com
http://sslprogrammingshool.com
http://ddossecureonline.com
http://sambukaclubonline.com
http://hlamidioz.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

http://onlinedatingsecretfriends.com/images/im133.jpg

http://onlinedatingsecretfriends.com/images/im134.jpg

Targets

- Target
  jaffacakes118__4002e1b18c94bb78ca1095bf3c73263f
- Size 187KB
- SHA256 fc49c0de0109c60ffcc2f9218e6c9f92d3ed5f089bdfe5b186caec0163a654e5
- MD5 4002e1b18c94bb78ca1095bf3c73263f
- SHA1 07e710c6f2f7a24666c6b7a59d2bd867cd1420ee
- SHA512 26ddf9a4361ef38f2bd62c2b509aade4fc45cd5c96a2c8b1e884ba33187ef887976c9800a166029f54bd6a1eff87c2c3b4a533c11c365eb6a5380dae286f600e
- SSDEEP 3072:jc/NAm/PF74riKg+K28FEJmCWSaMTxotw5JvfEhlXgTrV04mGhXzVUnW:j6NHabK28tCiMTxZJ3iXgy49hXiW
- TLSH
  T19714F1F1B8A58857E0FA843424978435F26666DAD3906CD6DE98833E2B5438CDC16FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- Drops desktop.ini file(s)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2