General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.ba23a2c9b9226489c9fb50cf8de02cfc
- Size 169KB
- Sample261006-ms2hpsxze1
- SHA256 2265db9caa2a36996cf5ae86c0b2df9ea11824deb81a4dd84575ba669af43078
- MD5 ba23a2c9b9226489c9fb50cf8de02cfc
- SHA1 9c03cb5683d8e13d9579c78cb7f2706f6783ed8c
- SHA512 ba6dae8220d86547bd349e61a8af6228027d0a7117310255715b95e26bdc60114849db589c072fe8fef0eb6f13816d64d7321db01649ad29a819ddc2c174a239
- SSDEEP 3072:2/nOGD1PCTOdMAH46bPG0HGq3AQsUsJsbFhMU4o31PT61J:+OGDlCiH1PdzAebFhTV3V61
- TLSH T1DC04F096D837CA9AF3FD53B42CD7DB6A678A50C27201B82D06E9C2F93065B153C3B185
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://onlinehelptoall.com
-
http://yourmediaspace.com
-
http://skymediaportal.com
-
http://onlinefilepanel.com
-
http://highqualitypicturestore.com
-
http://nosmockingheres.com
-
http://stotre4image.com
-
http://allsoft4you.com
-
http://videocontainer.com
-
http://maxtroeurosys.com
-
payload_url
http://armoredlegion.com/305986.png
http://armoredlegion.com/16354.png
http://armoredlegion.com/716354_m61.png
http://mektek.net/thelab/wiley.jpg
http://knowledgesutra.com/img/temp/hi.cgi
http://knowledgesutra.com/img/temp/head.png
http://battleon.com/134.gif
http://battleon.com/132.gif
http://battleon.com/133.gif
http://browsermmorpg.com/images/cpc.png
http://browsermmorpg.com/images/cpc2.png
http://browsermmorpg.com/img/intel.gif
http://browsermmorpg.com/img/intel.jpg
http://012webpages.com/christian12.jpg
http://012webpages.com/christian13.jpg
http://012webpages.com/christian14.jpg
http://tri-countymech.com/g/livechat.png
http://tri-countymech.com/g/logo.png
http://tri-countymech.com/g/133.jpg
http://tri-countymech.com/g/134.jpg
http://electronicstheory.com/pics/valley.png
http://electronicstheory.com/pics/sun.png
http://classicbattletech.com/lhous3.gif
http://classicbattletech.com/lhous4.gif
http://classicbattletech.com/lhous5.gif
http://classicbattletech.com/lhous6.gif
http://engineeringcrossing.com/images/misc/23525.png
http://engineeringcrossing.com/images/misc/64646.png
Targets
-
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.ba23a2c9b9226489c9fb50cf8de02cfc
- Size 169KB
- SHA256 2265db9caa2a36996cf5ae86c0b2df9ea11824deb81a4dd84575ba669af43078
- MD5 ba23a2c9b9226489c9fb50cf8de02cfc
- SHA1 9c03cb5683d8e13d9579c78cb7f2706f6783ed8c
- SHA512 ba6dae8220d86547bd349e61a8af6228027d0a7117310255715b95e26bdc60114849db589c072fe8fef0eb6f13816d64d7321db01649ad29a819ddc2c174a239
- SSDEEP 3072:2/nOGD1PCTOdMAH46bPG0HGq3AQsUsJsbFhMU4o31PT61J:+OGDlCiH1PdzAebFhTV3V61
- TLSH T1DC04F096D837CA9AF3FD53B42CD7DB6A678A50C27201B82D06E9C2F93065B153C3B185
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
Executes dropped EXE
-
Adds Run key to start application