cycbot | 42571f4e135e7017d036f6b3f2f6f2ddf66e6fff1da6e4b2f253c9f724ce9a75

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 177KB
Sample261013-31d1dady2l
SHA256 42571f4e135e7017d036f6b3f2f6f2ddf66e6fff1da6e4b2f253c9f724ce9a75
MD5 1ff3e43128deddddb38946ee53f885be
SHA1 7c9ee59786a0a7a7666f1c9433095c756981eacb
SHA512 804f9b07caff38012f2d2b4139fd8138a50797bc3d12b4b4fd5c2efe663b4f230e60975ee6d7ac278ac21b72e2bfbeca2b90e4be4814c0ca80984f01f0c2b723
SSDEEP 3072:AWdbPD3RVFNvm8L8ds89HNnXbIygHVP3txJDnWUUXK6sAkqOjwPp1ipLitl9:XhPDH/vfL8dV9HNMygHVPrVWUUXK8kqt
TLSH
T1F004E08E2533AD3CEB3580343A208DB6565E2F95B1D01BCF8369B7580ABF1095F974A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/4112-11-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1292-12-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/4376-134-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1292-135-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1292-295-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\8BD86\\4570D.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4112-11-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1292-12-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4376-134-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1292-135-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1292-295-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5404	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5404	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5404	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5404	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 4112	1292	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 1292 wrote to memory of 4376	1292	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Modifies WinLogon for persistence
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\LP\0D88\4E3.exe%C:\Program Files (x86)\LP\0D88
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4112
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\86FCB\lvvm.exe%C:\Program Files (x86)\86FCB
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4376

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\8BD86\4570D.exe
1⤵
PID:2508

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6FCB.BD8

Path C:\Users\Admin\AppData\Roaming\8BD86\6FCB.BD8
Size 996B
SHA256 4b403c56e7c2246ec026351e0aadb0a33fc8a3b9fe1aab03c20cbbd6cf3978e4
MD5 f9308acaa817bc8f3ec8c024c82a9c3b
SHA1 db97f8769f2b6e100f5e96007571a0e6694dce67
SHA512 6df22fbe9b47dd4653375ca1a2f74fde1022972c09857ea7a8e0d640a8103adfb5f573e117f09c121cf0ce92bf3ce2300084f128d4241e570c36e579f3ba70cd
TLSH
T148118C175FC00D28C5240577164723227BF8DB986102F79B968719962DD2628DC1C4F8
MD5 SHA1 SHA512 TLSH

Submit Download

6FCB.BD8

Path C:\Users\Admin\AppData\Roaming\8BD86\6FCB.BD8
Size 600B
SHA256 d413bc49f81270d5ca8662b4976c40fe80f64a66325b020a4a0042a6993e0cf4
MD5 300a79618bd09f114611c1a09c706d07
SHA1 c914f3509caac25aad8d6c473ba7ec6d753111c2
SHA512 d735d70ea70d708986546ac084643a3c140a2453ea73d755e56c3e3e58107267f3bdd8cec610bd89c640397a7f2414eb86487956a43ca3f5449809ae4beb4020
TLSH
T1C5F02203C2000220CAB00CB202030323E30C2000A20023CA8B030CE22C00C30C00C808
MD5 SHA1 SHA512 TLSH

Submit Download

6FCB.BD8

Path C:\Users\Admin\AppData\Roaming\8BD86\6FCB.BD8
Size 1KB
SHA256 a3490176587260aca58ca86293f26ea6a034a865ca143444c0340559cfcb21c4
MD5 987eca074ab399904b44cf78ff0ef872
SHA1 e80d874d1f2e9acfe219b5aaed6fe299b0d0c6b5
SHA512 dd3bb5b6f48b05884a8122c25130f230d5210b6dcb165cc61ed4338488918c2db4c23e95939381ab7e9c6d343b25057f43059ceb8fa75a69cac1d4174d53e84f
TLSH
T13431C2172FC02D28C4248177134733723FF9DB586142FB6B968B25951DD2609DC2D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1292-1-0x00000000007B0000-0x00000000008B0000-memory.dmp

Download

memory/1292-12-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/1292-13-0x00000000007B0000-0x00000000008B0000-memory.dmp

Download

memory/1292-135-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/1292-295-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/4112-11-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/4376-134-0x0000000000400000-0x0000000000491000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads