General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.35ec64fd3ee38f7c47382bf49a954884
- Size 194KB
- Sample261014-bthlfatw8p
- SHA256 9ee033d880444830beb927a3b2fc780a9c51402f6f01e3fa1f45c78c2267f506
- MD5 35ec64fd3ee38f7c47382bf49a954884
- SHA1 eb010c4d5d03fc14b6fb3b6dc9735a561305b6ef
- SHA512 772529f7566c1ce9029ec46b631a990382a1dd43766bb8f9037f7218feba529b00c8662c7e1000ba8f0e2d49e8376fe0eca6a01a3f050cc90f01ea00764ad622
- SSDEEP 6144:YJE7PdX1Q9yFdUIJXmablXWE0pzDr1L9WPF0A:YyR1fqIJ2cEFr1oNP
- TLSH T12A1401A02423CD5CD8F6443DB037E336B35C605257A9A8CBBEC51A6E7F0958836177EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://onlinesearchdb.com
-
http://yourmediaresources.com
-
http://yourblogresources.com
-
http://coolmediastore.com
-
http://imagestorage4all.com
-
http://ourfreefilesearch.com
-
http://stotre4image.com
-
http://allsoft4you.com
-
http://videocontainer.com
-
http://maxtroeurosys.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.35ec64fd3ee38f7c47382bf49a954884
- Size 194KB
- SHA256 9ee033d880444830beb927a3b2fc780a9c51402f6f01e3fa1f45c78c2267f506
- MD5 35ec64fd3ee38f7c47382bf49a954884
- SHA1 eb010c4d5d03fc14b6fb3b6dc9735a561305b6ef
- SHA512 772529f7566c1ce9029ec46b631a990382a1dd43766bb8f9037f7218feba529b00c8662c7e1000ba8f0e2d49e8376fe0eca6a01a3f050cc90f01ea00764ad622
- SSDEEP 6144:YJE7PdX1Q9yFdUIJXmablXWE0pzDr1L9WPF0A:YyR1fqIJ2cEFr1oNP
- TLSH T12A1401A02423CD5CD8F6443DB037E336B35C605257A9A8CBBEC51A6E7F0958836177EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.