cycbot | 4467fbdea71eb3ca4f3ed32e5b214c7aad268fdd0c347a758a04919014098ffc

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/09/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__114f29e819690690bf6c107028d57cc9.exe
Size 178KB
Sample260921-ltpd4afe86
SHA256 4467fbdea71eb3ca4f3ed32e5b214c7aad268fdd0c347a758a04919014098ffc
MD5 114f29e819690690bf6c107028d57cc9
SHA1 9987c77f407dd1d93d443e39aba70fc220ba750e
SHA512 eff23569bfce61531914e2042bfcb4680e297154c79e1ba985a8fe6656d370363ba62d8b0850366a89a427593681af5e74fc3e4d9316594693e1f9d0b8fdf1cc
SSDEEP 3072:hX7uC+dP3n7sb9i9Nxhh6+ZxODmhihD+ZC5rF5KW/4r9JrsSAFr:hSCWP37vnxhcyh6+ZCRF5KK4bU
TLSH
T1DD04F1F52886596BE1FCC43914E38476B6585A13D3A81AD2DE4447FE3B2034EDC1AFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery cycbot rat upx

Malware Config

Extracted

Family

cycbot

http://fxsystemsone.com
http://killprocessoffline.com
http://repairshampoo.com
http://bigbadhead.com
http://freeservermonitorings.com
http://myonlinefreelibrarry.com
http://itshopsonline.com
http://securityshllsonline.com
http://laporoskopia.com
http://freewhoisdb.com
http://sslprogrammingshool.com
http://ddossecureonline.com
http://sambukaclubonline.com
http://hlamidioz.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

http://onlinedatingsecretfriends.com/images/im133.jpg

http://onlinedatingsecretfriends.com/images/im134.jpg

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2500-12-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/4712-73-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/3932-75-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/4712-148-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2500-12-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4712-73-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/3932-75-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4712-148-0x0000000000400000-0x000000000046B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__114f29e819690690bf6c107028d57cc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__114f29e819690690bf6c107028d57cc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__114f29e819690690bf6c107028d57cc9.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2500	4712	jaffacakes118__114f29e819690690bf6c107028d57cc9.exe	91
PID 4712 wrote to memory of 3932	4712	jaffacakes118__114f29e819690690bf6c107028d57cc9.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__114f29e819690690bf6c107028d57cc9.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__114f29e819690690bf6c107028d57cc9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__114f29e819690690bf6c107028d57cc9.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118__114f29e819690690bf6c107028d57cc9.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__114f29e819690690bf6c107028d57cc9.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118__114f29e819690690bf6c107028d57cc9.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2C22.039

Path C:\Users\Admin\AppData\Roaming\2C22.039
Size 1KB
SHA256 a6886674e49a7e2ac1d74ce371ca347c9373fbc280dab8d75386d19853189d26
MD5 0e8b438ae229874841a07f5a6888c6ff
SHA1 dd90f086b71269b7e0ed6017f205546c58312249
SHA512 d0ba43d45312a296501457eceafc35c47960b82f9ed8b4239b1687e6ff4e2789a889c13552361a4df5e6ce3952ebe998d3223f1bdb85cfa61b21986df677d20a
TLSH
T16C318CAAFFC52AA2E804447B229E5FA4AB85A25632C4DF4FE5D215801CC12462C22BC4
MD5 SHA1 SHA512 TLSH

Submit Download

2C22.039

Path C:\Users\Admin\AppData\Roaming\2C22.039
Size 600B
SHA256 428c46765941ce234daac512e2e3acafb3c9d1b25f28ce8ff03ade78059acdaf
MD5 61c905c734a1d51448d2f922cca361f6
SHA1 caeb35f7c664152debd63fff660cc8ec30d14801
SHA512 baf6d6d0bf6b08726e03fd0628393577d033a582ae705d5548cddc973bdb77f727d919ecc23135e5ee477d23ac8284010cdc18d1a1fb25b4105b2f8fb2148377
TLSH
T1F0F02200FCA02323F0008C3E820B0838CF08F800B38003C232C028822C002B0A032830
MD5 SHA1 SHA512 TLSH

Submit Download

2C22.039

Path C:\Users\Admin\AppData\Roaming\2C22.039
Size 996B
SHA256 241cccc18a141610835804ed43c5b79da3a0fca207b7302490f238940ae8ca5a
MD5 192c84eba831bd0c7c3e041ca794f0df
SHA1 124a0dee156b297e0cd153adc25400cd3ab5fb59
SHA512 3b20849c1214e6bdd435a253622ce9e8245c287e94f13b70a0c81d364fbf093d16c822228ee7f67a70a6e0dabb60287b1cd0d57a828a48d3b616ff75a5c83a00
TLSH
T1EB118005FFD42B52F804447B125B5F649B44E2453284974F61C611401CC13555C327D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2500-7-0x00000000005F0000-0x00000000006F0000-memory.dmp

Download

memory/2500-12-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/3932-74-0x0000000000660000-0x0000000000760000-memory.dmp

Download

memory/3932-75-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/4712-1-0x00000000007A0000-0x00000000008A0000-memory.dmp

Download

memory/4712-13-0x00000000007A0000-0x00000000008A0000-memory.dmp

Download

memory/4712-73-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/4712-148-0x0000000000400000-0x000000000046B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads