cycbot | b6e8f1d063fe3875b8df2569da09b4b3a8c73d039b8a3db55be78136591611b6

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 164KB
Sample261013-3gnepsvyaz
SHA256 b6e8f1d063fe3875b8df2569da09b4b3a8c73d039b8a3db55be78136591611b6
MD5 1aea1db2fe933e923e1fb34e5ff8a639
SHA1 fc6c294e1d8cf7e0179caa1553da508e43076038
SHA512 5d2a903bb3a62da9befb14f51682d74db53b5ad32a424f6a5ee5ff675e18f14bf6f4e4b62b42384f441cdc9fe29ef3a0c86e098090231077d1558cefe6feb2c1
SSDEEP 3072:2oHEp6YOzacMECahLGTIRSM1mJxzXkmqo414yvFbg4V4TQ9A:THZDmcMEC42IAomJxzUmgN5W
TLSH
T193F30286E4B3AE62F7392A3171D9027725BD6EA375834BDAE6FCD235444F0401B636C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3200-15-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/5752-17-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3268-125-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/5752-127-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/5752-295-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\C5F67\\7920D.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3200-15-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/5752-17-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3268-125-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/5752-127-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/5752-295-0x0000000000400000-0x0000000000490000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4764	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4764	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4764	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4764	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 3200	5752	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 5752 wrote to memory of 3268	5752	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Modifies WinLogon for persistence
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\LP\0D2C\F3F.exe%C:\Program Files (x86)\LP\0D2C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3200
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\67DE0\lvvm.exe%C:\Program Files (x86)\67DE0
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3268

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\C5F67\7920D.exe
1⤵
PID:2768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7DE0.5F6

Path C:\Users\Admin\AppData\Roaming\C5F67\7DE0.5F6
Size 600B
SHA256 6c611772af2b6c179b0a4fd01a93bd5a3492b1e4f674c1c7e90763747f96881e
MD5 87bb919d1470ae7ab320b62c536b72dd
SHA1 d9bbf7d0a5b9e5ff8fe73dbe7969d6bd71b9690b
SHA512 c9b12f0d1609a212acbb61ad931e8576be6a3df482a84760eec6e5e4ba243b3bb7d21db2c567463a16772a59efdd1e9f7d1057153bd4c2938cb94142b06b8c2c
TLSH
T1BAF02203C2000200CEA00CB22003233323882000AB00A3CAA8000CE0AC00830C00C808
MD5 SHA1 SHA512 TLSH

Submit Download

7DE0.5F6

Path C:\Users\Admin\AppData\Roaming\C5F67\7DE0.5F6
Size 996B
SHA256 bb71ed1a0375bee892606d6b82ebd1adfc47e264d4ebc9586fcb77e4ee416fd7
MD5 58ea4b02613f2cec17a91cc7a8ee42bf
SHA1 ab4a049406e60afcb9a42c741725b47886f4a074
SHA512 f1de067a20750c4cf5ce4769ed68d26caf0632e94f10ee0b8bd93f31ed6902df7c5039a808a7bb601639a0fe1e81839d7c9f5a99300ae40e1f8e7c1c200b2a37
TLSH
T11C118C47DBC40A51CE0016732247377237ECD78AAA41F78F664208B02EC51198E0C984
MD5 SHA1 SHA512 TLSH

Submit Download

7DE0.5F6

Path C:\Users\Admin\AppData\Roaming\C5F67\7DE0.5F6
Size 1KB
SHA256 5c71dc5169fe413234acd7701305a5758f6eea37ab19001d08085a92bd6c7f05
MD5 9459883330bb57592cf72a7ec27c26a3
SHA1 6a35494dd9d4c96c18a666deeb591d82a50c56bf
SHA512 bbec6c191f329ecfc040fa8114cf48fa8f14dde7a481ceb62e2a7013231f5b37278230258d5aa94dd27d7a7711476a259f47b866e37a52137c7f3559139a6923
TLSH
T109318C57AF881962C9006173224637703BEDD78A9A42FB8F664104B02EC251A8D188C0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3200-13-0x0000000075400000-0x000000007543B000-memory.dmp

Download

memory/3200-15-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3200-16-0x0000000075400000-0x000000007543B000-memory.dmp

Download

memory/3268-123-0x0000000075400000-0x000000007543B000-memory.dmp

Download

memory/3268-126-0x0000000075400000-0x000000007543B000-memory.dmp

Download

memory/3268-125-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5752-18-0x00000000007B0000-0x00000000008B0000-memory.dmp

Download

memory/5752-0-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5752-17-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5752-127-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5752-3-0x00000000007B0000-0x00000000008B0000-memory.dmp

Download

memory/5752-1-0x0000000075400000-0x000000007543B000-memory.dmp

Download

memory/5752-295-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/5752-297-0x0000000075400000-0x000000007543B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads