cycbot | 42571f4e135e7017d036f6b3f2f6f2ddf66e6fff1da6e4b2f253c9f724ce9a75

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.1ff3e43128deddddb38946ee53f885be
Size 177KB
Sample261013-31d1dady2l
SHA256 42571f4e135e7017d036f6b3f2f6f2ddf66e6fff1da6e4b2f253c9f724ce9a75
MD5 1ff3e43128deddddb38946ee53f885be
SHA1 7c9ee59786a0a7a7666f1c9433095c756981eacb
SHA512 804f9b07caff38012f2d2b4139fd8138a50797bc3d12b4b4fd5c2efe663b4f230e60975ee6d7ac278ac21b72e2bfbeca2b90e4be4814c0ca80984f01f0c2b723
SSDEEP 3072:AWdbPD3RVFNvm8L8ds89HNnXbIygHVP3txJDnWUUXK6sAkqOjwPp1ipLitl9:XhPDH/vfL8dV9HNMygHVPrVWUUXK8kqt
TLSH
T1F004E08E2533AD3CEB3580343A208DB6565E2F95B1D01BCF8369B7580ABF1095F974A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.1ff3e43128deddddb38946ee53f885be
- Size 177KB
- SHA256 42571f4e135e7017d036f6b3f2f6f2ddf66e6fff1da6e4b2f253c9f724ce9a75
- MD5 1ff3e43128deddddb38946ee53f885be
- SHA1 7c9ee59786a0a7a7666f1c9433095c756981eacb
- SHA512 804f9b07caff38012f2d2b4139fd8138a50797bc3d12b4b4fd5c2efe663b4f230e60975ee6d7ac278ac21b72e2bfbeca2b90e4be4814c0ca80984f01f0c2b723
- SSDEEP 3072:AWdbPD3RVFNvm8L8ds89HNnXbIygHVP3txJDnWUUXK6sAkqOjwPp1ipLitl9:XhPDH/vfL8dV9HNMygHVPrVWUUXK8kqt
- TLSH
  T1F004E08E2533AD3CEB3580343A208DB6565E2F95B1D01BCF8369B7580ABF1095F974A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2