General
- Target jaffacakes118_Trojan-PSW.Win32.Fareit.lc.5c2311f858dbc248bb90cf141d6a9e40
- Size 174KB
- Sample261010-pzy29sc18m
- SHA256 083391556ec5a2a3dc76aef12bc8b0494fcf94da4a821448febc9257f5828f74
- MD5 5c2311f858dbc248bb90cf141d6a9e40
- SHA1 0503918b2064b4c68f5a718677fc5852194c0d47
- SHA512 24338ed44d98890849ceef2f5f463394722e380b1f9129f9f81a7b17667c40a8d2aa5881851db95dce21274f7ec32b1f6e4f247a6db7e8c7d13a5638c1729b0f
- SSDEEP 3072:zoZBBSbXCXB0JWj8UOkeck7S7JP32fN9BK9VQruXcw:0rBSbrYvcGJP32fRK9iruXc
- TLSH T17C04F170E8365E1AE3A6C2792CD1B338E78660B3B15594283BE4D7EC3162750763F4DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-PSW.Win32.Fareit.lc.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://logstoreonline.com
-
http://jumptomoon.com
-
http://simplexstored.com
-
http://pdasoftstoreonline.com
-
http://speedhddrecovery.com
-
http://infobookbase.com
-
http://stotre4image.com
-
http://allsoft4you.com
-
http://videocontainer.com
-
http://maxtroeurosys.com
-
payload_url
http://armoredlegion.com/305986.png
http://armoredlegion.com/16354.png
http://armoredlegion.com/716354_m61.png
http://mektek.net/thelab/wiley.jpg
http://knowledgesutra.com/img/temp/hi.cgi
http://knowledgesutra.com/img/temp/head.png
http://battleon.com/134.gif
http://battleon.com/132.gif
http://battleon.com/133.gif
http://browsermmorpg.com/images/cpc.png
http://browsermmorpg.com/images/cpc2.png
http://browsermmorpg.com/img/intel.gif
http://browsermmorpg.com/img/intel.jpg
http://012webpages.com/christian12.jpg
http://012webpages.com/christian13.jpg
http://012webpages.com/christian14.jpg
http://tri-countymech.com/g/livechat.png
http://tri-countymech.com/g/logo.png
http://tri-countymech.com/g/133.jpg
http://tri-countymech.com/g/134.jpg
http://electronicstheory.com/pics/valley.png
http://electronicstheory.com/pics/sun.png
http://classicbattletech.com/lhous3.gif
http://classicbattletech.com/lhous4.gif
http://classicbattletech.com/lhous5.gif
http://classicbattletech.com/lhous6.gif
http://engineeringcrossing.com/images/misc/23525.png
http://engineeringcrossing.com/images/misc/64646.png
Targets
-
- Target jaffacakes118_Trojan-PSW.Win32.Fareit.lc.5c2311f858dbc248bb90cf141d6a9e40
- Size 174KB
- SHA256 083391556ec5a2a3dc76aef12bc8b0494fcf94da4a821448febc9257f5828f74
- MD5 5c2311f858dbc248bb90cf141d6a9e40
- SHA1 0503918b2064b4c68f5a718677fc5852194c0d47
- SHA512 24338ed44d98890849ceef2f5f463394722e380b1f9129f9f81a7b17667c40a8d2aa5881851db95dce21274f7ec32b1f6e4f247a6db7e8c7d13a5638c1729b0f
- SSDEEP 3072:zoZBBSbXCXB0JWj8UOkeck7S7JP32fN9BK9VQruXcw:0rBSbrYvcGJP32fRK9iruXc
- TLSH T17C04F170E8365E1AE3A6C2792CD1B338E78660B3B15594283BE4D7EC3162750763F4DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
Modifies WinLogon for persistence