cycbot | 28c0a916f0f47696c471bec3285b73fb9439752bbdb689326dd5e35f504f56a8

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 163KB
Sample261014-ayc13sts9j
SHA256 28c0a916f0f47696c471bec3285b73fb9439752bbdb689326dd5e35f504f56a8
MD5 2ae65f7034b2a6df58016a86eb0e280b
SHA1 01ae25adf4d72cecc1094ddff78eb67ecf44d3fe
SHA512 939141927040248fc5c7560e5653e466e35c1967104a8b7c0a3c41f6685f304c86fc07029c3c1ebbd8350d3332943b58111c6b452207dbbc67863738e264788c
SSDEEP 3072:AJShfZ6uvCu3HQOTSK5pxFqo5ywRgcchQ6xEyoV3Fc:RhfZpCswOTSC9lRgYVP
TLSH
T134F3F18666B66D11F7B1503350198370023C731FBA908FDEB6E4DAF2262F26297E95D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3736-13-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/2332-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1220-133-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/2332-134-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/2332-322-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\8C729\\6A825.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3736-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/2332-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1220-133-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/2332-134-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/2332-322-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3748	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3748	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3748	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3748	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3736	2332	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2332 wrote to memory of 1220	2332	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Modifies WinLogon for persistence
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\LP\25A8\49B.exe%C:\Program Files (x86)\LP\25A8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3736
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\298D5\lvvm.exe%C:\Program Files (x86)\298D5
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1220

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\8C729\6A825.exe
1⤵
PID:5916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

98D5.C72

Path C:\Users\Admin\AppData\Roaming\8C729\98D5.C72
Size 996B
SHA256 0e27b5810002fe08ea94ee991016112bd69beb5f84a9b37854ffbc7e6300ae09
MD5 ec66ad5a0d7d1cfb9b3d9c6d61cdccb3
SHA1 c9b5b8d4489ddafb9d53647640e4307469c4f7a3
SHA512 41d976b15693f5cef4a0d7144ffa52f03db8bf7d5be03c64489e8ad5468ceea36d22ae1ad53ed7c07fcfb37a14ccf233f8241fb1a41e67ff446c682943d1b66a
TLSH
T1E1118C16ABC08951D60809772D873361B3ECE38D7990A7DBA98208B41CC1210EE099E9
MD5 SHA1 SHA512 TLSH

Submit Download

98D5.C72

Path C:\Users\Admin\AppData\Roaming\8C729\98D5.C72
Size 600B
SHA256 70f5b774de4f81dfd5ad899d788a87cc3f4527a49d48f763e9abce5c9237a97e
MD5 b531985440ec7de6a0b4815e7a70505e
SHA1 501e239a403a1776a48319a495846c2b8a7bf422
SHA512 a2247b75b5496b2901e421df16e7a085ae4d7b28c4da6c8b5e2374b42334eba2e18a7739e1d78810860084f6b7736fc41ff186dba386e0a007d0d20b7dc250b6
TLSH
T1ABF02203E200C200C0A80CBA20030323A3282000B20023CA88800CE22CC0830E00CC28
MD5 SHA1 SHA512 TLSH

Submit Download

98D5.C72

Path C:\Users\Admin\AppData\Roaming\8C729\98D5.C72
Size 1KB
SHA256 c12e260cb1a2285e42e28b0db5570d52f86630cc87a3e85af0230b84e4c6175c
MD5 d849d9656e88c6170166232b601596e0
SHA1 48aa9c056d8869be71373d0116e667217c19c89f
SHA512 102c4d67be33b25b198294c40c57c50afef72962060ce42682a957e1ab4c3c8217ff2b5ebd22a102b4aead63f02305718366c25f40fb7fb4cedfa2b2038e98f6
TLSH
T1ED31C22A6BC058A6C50815732E873320B3EDE38D2C80ABDBEA8244B44CC2240EE199E4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1220-133-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2332-0-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2332-2-0x00000000005F0000-0x00000000006F0000-memory.dmp

Download

memory/2332-14-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2332-15-0x00000000005F0000-0x00000000006F0000-memory.dmp

Download

memory/2332-134-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/2332-322-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/3736-13-0x0000000000400000-0x0000000000491000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads