cycbot | b6e8f1d063fe3875b8df2569da09b4b3a8c73d039b8a3db55be78136591611b6

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.1aea1db2fe933e923e1fb34e5ff8a639
Size 164KB
Sample261013-3gnepsvyaz
SHA256 b6e8f1d063fe3875b8df2569da09b4b3a8c73d039b8a3db55be78136591611b6
MD5 1aea1db2fe933e923e1fb34e5ff8a639
SHA1 fc6c294e1d8cf7e0179caa1553da508e43076038
SHA512 5d2a903bb3a62da9befb14f51682d74db53b5ad32a424f6a5ee5ff675e18f14bf6f4e4b62b42384f441cdc9fe29ef3a0c86e098090231077d1558cefe6feb2c1
SSDEEP 3072:2oHEp6YOzacMECahLGTIRSM1mJxzXkmqo414yvFbg4V4TQ9A:THZDmcMEC42IAomJxzUmgN5W
TLSH
T193F30286E4B3AE62F7392A3171D9027725BD6EA375834BDAE6FCD235444F0401B636C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.1aea1db2fe933e923e1fb34e5ff8a639
- Size 164KB
- SHA256 b6e8f1d063fe3875b8df2569da09b4b3a8c73d039b8a3db55be78136591611b6
- MD5 1aea1db2fe933e923e1fb34e5ff8a639
- SHA1 fc6c294e1d8cf7e0179caa1553da508e43076038
- SHA512 5d2a903bb3a62da9befb14f51682d74db53b5ad32a424f6a5ee5ff675e18f14bf6f4e4b62b42384f441cdc9fe29ef3a0c86e098090231077d1558cefe6feb2c1
- SSDEEP 3072:2oHEp6YOzacMECahLGTIRSM1mJxzXkmqo414yvFbg4V4TQ9A:THZDmcMEC42IAomJxzUmgN5W
- TLSH
  T193F30286E4B3AE62F7392A3171D9027725BD6EA375834BDAE6FCD235444F0401B636C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2