cycbot | 85a470213d701bd260f889776eee14a064bf6f2097ed85f25c4dfb2668ff8704

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0cef24b336d48eae27578e7b4dcfcea8
Size 172KB
Sample261013-2ahefade59
SHA256 85a470213d701bd260f889776eee14a064bf6f2097ed85f25c4dfb2668ff8704
MD5 0cef24b336d48eae27578e7b4dcfcea8
SHA1 1cd11f734c1064a1140558404b8c37ad0e7eea4b
SHA512 970e5175e6eda82080b29d24960afdf7e5730aacd01e8df47b5bb38a7d289e1ad198d74d49b087ab0ffd9ce2bd247f90b86431536abe309340fff75cb081218d
SSDEEP 3072:C05AcymMPxdQfnwblIVA87e61PmhT0bBaJdYFKiHcby5SS5BO/l9/jXW+g37kdLY:5CcP0QfAav1PmhYB/KUvh5c99/jXWN3X
TLSH
T1F304E051F172D98DFBFD12B02DC69624F3661062F240366A3A96D2FDB162B703837B94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

C2

http://yourhqimages.com
http://systems-datadc.com
http://goldenfilestorage.com
http://bigcherrybox.com
http://onlinemediacontrol.com
http://ultradiscofx.com
http://stotre4image.com
http://allsoft4you.com
http://videocontainer.com
http://maxtroeurosys.com

Attributes

payload_url
http://armoredlegion.com/305986.png

http://armoredlegion.com/16354.png

http://armoredlegion.com/716354_m61.png

http://mektek.net/thelab/wiley.jpg

http://knowledgesutra.com/img/temp/hi.cgi

http://knowledgesutra.com/img/temp/head.png

http://battleon.com/134.gif

http://battleon.com/132.gif

http://battleon.com/133.gif

http://browsermmorpg.com/images/cpc.png

http://browsermmorpg.com/images/cpc2.png

http://browsermmorpg.com/img/intel.gif

http://browsermmorpg.com/img/intel.jpg

http://012webpages.com/christian12.jpg

http://012webpages.com/christian13.jpg

http://012webpages.com/christian14.jpg

http://tri-countymech.com/g/livechat.png

http://tri-countymech.com/g/logo.png

http://tri-countymech.com/g/133.jpg

http://tri-countymech.com/g/134.jpg

http://electronicstheory.com/pics/valley.png

http://electronicstheory.com/pics/sun.png

http://classicbattletech.com/lhous3.gif

http://classicbattletech.com/lhous4.gif

http://classicbattletech.com/lhous5.gif

http://classicbattletech.com/lhous6.gif

http://engineeringcrossing.com/images/misc/23525.png

http://engineeringcrossing.com/images/misc/64646.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.0cef24b336d48eae27578e7b4dcfcea8
- Size 172KB
- SHA256 85a470213d701bd260f889776eee14a064bf6f2097ed85f25c4dfb2668ff8704
- MD5 0cef24b336d48eae27578e7b4dcfcea8
- SHA1 1cd11f734c1064a1140558404b8c37ad0e7eea4b
- SHA512 970e5175e6eda82080b29d24960afdf7e5730aacd01e8df47b5bb38a7d289e1ad198d74d49b087ab0ffd9ce2bd247f90b86431536abe309340fff75cb081218d
- SSDEEP 3072:C05AcymMPxdQfnwblIVA87e61PmhT0bBaJdYFKiHcby5SS5BO/l9/jXW+g37kdLY:5CcP0QfAav1PmhYB/KUvh5c99/jXWN3X
- TLSH
  T1F304E051F172D98DFBFD12B02DC69624F3661062F240366A3A96D2FDB162B703837B94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery cycbot persistence ransomware rat upx adware spyware
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies security service
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables taskbar notifications via registry modification
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2