cycbot | 3376d311a8cbca810f41f14a890be909f46ebb6a22ec138003d9a2d5d21ec57c

General

Target
jaffacakes118_Trojan-FakeAV.Win32.AVGuard.c.f1e9abac7fb1f446448ee0f046204663
Size 174KB
Sample261009-1b3akacv2m
SHA256 3376d311a8cbca810f41f14a890be909f46ebb6a22ec138003d9a2d5d21ec57c
MD5 f1e9abac7fb1f446448ee0f046204663
SHA1 eb7bb1e54fb92c24d0eca52a0f11acd452917829
SHA512 9203b523b06bd198d7925986b39b51c2523f6a97855d2c6bbbff9e2242987ab25c23a0637685b4d88b06a2cd1b56fc147855ad34426e62de930f1422f979487e
SSDEEP 3072:qK8p385YW8xyQaqdx8PtKH09t+/wi690xV8vsL+LTfMG01EhltY/II5+3HCaR1zC:q3cwyQDdx8A0WQKV8ES8H1Qg7s3HCa7C
TLSH
T13904E025D836D48AE7FE43F13DEBD928F3652183BA407914A6A5D2F6B4A77603433290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

C2

http://onlinehelptoall.com
http://yourmediaspace.com
http://skymediaportal.com
http://onlinefilepanel.com
http://highqualitypicturestore.com
http://nosmockingheres.com
http://stotre4image.com
http://allsoft4you.com
http://videocontainer.com
http://maxtroeurosys.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

Targets

- Target
  jaffacakes118_Trojan-FakeAV.Win32.AVGuard.c.f1e9abac7fb1f446448ee0f046204663
- Size 174KB
- SHA256 3376d311a8cbca810f41f14a890be909f46ebb6a22ec138003d9a2d5d21ec57c
- MD5 f1e9abac7fb1f446448ee0f046204663
- SHA1 eb7bb1e54fb92c24d0eca52a0f11acd452917829
- SHA512 9203b523b06bd198d7925986b39b51c2523f6a97855d2c6bbbff9e2242987ab25c23a0637685b4d88b06a2cd1b56fc147855ad34426e62de930f1422f979487e
- SSDEEP 3072:qK8p385YW8xyQaqdx8PtKH09t+/wi690xV8vsL+LTfMG01EhltY/II5+3HCaR1zC:q3cwyQDdx8A0WQKV8ES8H1Qg7s3HCa7C
- TLSH
  T13904E025D836D48AE7FE43F13DEBD928F3652183BA407914A6A5D2F6B4A77603433290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery cycbot persistence rat upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2