General
- Target jaffacakes118__114f29e819690690bf6c107028d57cc9
- Size 178KB
- Sample260921-ltpd4afe86
- SHA256 4467fbdea71eb3ca4f3ed32e5b214c7aad268fdd0c347a758a04919014098ffc
- MD5 114f29e819690690bf6c107028d57cc9
- SHA1 9987c77f407dd1d93d443e39aba70fc220ba750e
- SHA512 eff23569bfce61531914e2042bfcb4680e297154c79e1ba985a8fe6656d370363ba62d8b0850366a89a427593681af5e74fc3e4d9316594693e1f9d0b8fdf1cc
- SSDEEP 3072:hX7uC+dP3n7sb9i9Nxhh6+ZxODmhihD+ZC5rF5KW/4r9JrsSAFr:hSCWP37vnxhcyh6+ZCRF5KK4bU
- TLSH T1DD04F1F52886596BE1FCC43914E38476B6585A13D3A81AD2DE4447FE3B2034EDC1AFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118__114f29e819690690bf6c107028d57cc9.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://fxsystemsone.com
-
http://killprocessoffline.com
-
http://repairshampoo.com
-
http://bigbadhead.com
-
http://freeservermonitorings.com
-
http://myonlinefreelibrarry.com
-
http://itshopsonline.com
-
http://securityshllsonline.com
-
http://laporoskopia.com
-
http://freewhoisdb.com
-
http://sslprogrammingshool.com
-
http://ddossecureonline.com
-
http://sambukaclubonline.com
-
http://hlamidioz.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118__114f29e819690690bf6c107028d57cc9
- Size 178KB
- SHA256 4467fbdea71eb3ca4f3ed32e5b214c7aad268fdd0c347a758a04919014098ffc
- MD5 114f29e819690690bf6c107028d57cc9
- SHA1 9987c77f407dd1d93d443e39aba70fc220ba750e
- SHA512 eff23569bfce61531914e2042bfcb4680e297154c79e1ba985a8fe6656d370363ba62d8b0850366a89a427593681af5e74fc3e4d9316594693e1f9d0b8fdf1cc
- SSDEEP 3072:hX7uC+dP3n7sb9i9Nxhh6+ZxODmhihD+ZC5rF5KW/4r9JrsSAFr:hSCWP37vnxhcyh6+ZCRF5KK4bU
- TLSH T1DD04F1F52886596BE1FCC43914E38476B6585A13D3A81AD2DE4447FE3B2034EDC1AFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.