Overview

overview

10

Static

static

3

jaffacakes...ic.exe

windows10-2004-x64

10

jaffacakes...ic.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.b088a391e8980f4b8e7e6ff6fc525088
  • Size 200KB
  • Sample261006-mr4axaas2p
  • SHA256 6d80b24dbe6fea100aa84e52fecff556ee7e5bf183f110dd28133e18a567d54c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cycbotbackdoordiscoveryratupx

Malware Config

Extracted

Family

  • cycbot

Attributes
  • payload_url

    http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

    http://binghamtonschools.org/images/297893.jpg

    http://binghamtonschools.org/images/297894.jpg

    http://alleducationalsoftware.com/creditcardlogos.gif

    http://alleducationalsoftware.com/creditcard.png

    http://alleducationalsoftware.com/creditcard2.png

    http://patentgenius.com/temp/head.png

    http://patentgenius.com/132.gif

    http://patentgenius.com/133.gif

    http://freedownload3.com/screenshot/4/s/89_3276.gif

    http://freedownload3.com/screenshot/4/s/89_3277.gif

    http://freedownload3.com/screenshot/4/s/89_3278.gif

    http://istockanalyst.com/png/intel.gif

    http://istockanalyst.com/png/intel.jpg

    http://istockanalyst.com/12.jpg

    http://complaintsboard.com/complaints/logo.png

    http://complaintsboard.com/complaints/zip.png

    http://complaintsboard.com/complaints/rar.png

    http://highspeedinternetlosangeles.webnode.com/news/1.cgi

    http://highspeedinternetlosangeles.webnode.com/news/1.php

    http://highspeedinternetlosangeles.webnode.com/news/2.php

    http://newworldorderreport.com/favicon.ico

    http://newworldorderreport.com/img/3421.png

    http://newworldorderreport.com/img/3422.png

    http://jointhenewworldorder.com/images/pages.jpg

    http://jointhenewworldorder.com/images/pages.png

    http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

    http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

    http://cdn.adventofdeception.com/logo.png

    http://%s/s.php?c=121&id=%s

Targets

    • Target
      jaffacakes118_HEUR.Trojan.Win32.Generic.b088a391e8980f4b8e7e6ff6fc525088
    • Size 200KB
    • SHA256 6d80b24dbe6fea100aa84e52fecff556ee7e5bf183f110dd28133e18a567d54c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoverycycbotratupx

    • Detects Cycbot payload

      Cycbot is a backdoor and trojan written in C++.

    • Family: Cycbot

      Cycbot is a backdoor and trojan written in C++..

      backdoorratcycbot

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks