General
- Target jaffacakes118__05f8a100844b03b29872c5d65987202f
- Size 172KB
- Sample260921-thdr8as13l
- SHA256 48fb99b57cc73677bfa1b87f231cb29cde63473ea8ad8b0c38b11e13673ebecb
- MD5 05f8a100844b03b29872c5d65987202f
- SHA1 32f3761e2971b018c549bde330211bcd715014fb
- SHA512 180651239cb6473e6e5a624a15e815e158ad2eff8c19639b919af5e2ded1984693d204e769c9222e7e921eafc4c19de9d0688ad2e72ff81dd0022d7a6c4a732b
- SSDEEP 3072:M1x7DSDP8qO0zi7RMdfyftz6ny7B2RXPCFiNGiR+6eLW07u08mxoU:M2kqO0zi7Rrf1OyFi3eq2u08P
- TLSH T1D504F116D933C948D7FC13B87CD38B18B3A96166B202782E6684E1FBF191B7079335A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118__05f8a100844b03b29872c5d65987202f.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://onlinehelptoall.com
-
http://yourmediaspace.com
-
http://skymediaportal.com
-
http://onlinefilepanel.com
-
http://highqualitypicturestore.com
-
http://nosmockingheres.com
-
http://stotre4image.com
-
http://allsoft4you.com
-
http://videocontainer.com
-
http://maxtroeurosys.com
-
payload_url
http://armoredlegion.com/305986.png
http://armoredlegion.com/16354.png
http://armoredlegion.com/716354_m61.png
http://mektek.net/thelab/wiley.jpg
http://knowledgesutra.com/img/temp/hi.cgi
http://knowledgesutra.com/img/temp/head.png
http://battleon.com/134.gif
http://battleon.com/132.gif
http://battleon.com/133.gif
http://browsermmorpg.com/images/cpc.png
http://browsermmorpg.com/images/cpc2.png
http://browsermmorpg.com/img/intel.gif
http://browsermmorpg.com/img/intel.jpg
http://012webpages.com/christian12.jpg
http://012webpages.com/christian13.jpg
http://012webpages.com/christian14.jpg
http://tri-countymech.com/g/livechat.png
http://tri-countymech.com/g/logo.png
http://tri-countymech.com/g/133.jpg
http://tri-countymech.com/g/134.jpg
http://electronicstheory.com/pics/valley.png
http://electronicstheory.com/pics/sun.png
http://classicbattletech.com/lhous3.gif
http://classicbattletech.com/lhous4.gif
http://classicbattletech.com/lhous5.gif
http://classicbattletech.com/lhous6.gif
http://engineeringcrossing.com/images/misc/23525.png
http://engineeringcrossing.com/images/misc/64646.png
Targets
-
- Target jaffacakes118__05f8a100844b03b29872c5d65987202f
- Size 172KB
- SHA256 48fb99b57cc73677bfa1b87f231cb29cde63473ea8ad8b0c38b11e13673ebecb
- MD5 05f8a100844b03b29872c5d65987202f
- SHA1 32f3761e2971b018c549bde330211bcd715014fb
- SHA512 180651239cb6473e6e5a624a15e815e158ad2eff8c19639b919af5e2ded1984693d204e769c9222e7e921eafc4c19de9d0688ad2e72ff81dd0022d7a6c4a732b
- SSDEEP 3072:M1x7DSDP8qO0zi7RMdfyftz6ny7B2RXPCFiNGiR+6eLW07u08mxoU:M2kqO0zi7Rrf1OyFi3eq2u08P
- TLSH T1D504F116D933C948D7FC13B87CD38B18B3A96166B202782E6684E1FBF191B7079335A5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
Modifies WinLogon for persistence
-
Drops desktop.ini file(s)