General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.4a037f781245f583de9e9e0f83303b26
- Size 191KB
- Sample261014-c5qxmaxves
- SHA256 4b8523492d9d06ebd9f8127b0414b249294dc08c9a8d70d0117ff363f134d4f5
- MD5 4a037f781245f583de9e9e0f83303b26
- SHA1 f83db552ad29266381694ec839da14653084ef3b
- SHA512 cb1cbad1ddcc64c81e34fe1009b024c5a5300e221c6bea994d068961415da35db6a0d345f75ee1ac2a21fa9cec92b628c1935b2723d37d0030b07638c9f00471
- SSDEEP 3072:cPrcNY+evWLpvP46kxl9NnBne6ItAKz1XOxf3tGcjeGShKuBaGirak5LXzgQzsOW:cANTevY4HdHIeKz1Of3njeG7ak5DzlzT
- TLSH T12E14E0F83550959FD0FE803069A399BBB3AD21D9C39449C6EE68533D2B6631CCC26F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://fxsystemsone.com
-
http://killprocessoffline.com
-
http://repairshampoo.com
-
http://bigbadhead.com
-
http://freeservermonitorings.com
-
http://myonlinefreelibrarry.com
-
http://itshopsonline.com
-
http://securityshllsonline.com
-
http://laporoskopia.com
-
http://freewhoisdb.com
-
http://sslprogrammingshool.com
-
http://ddossecureonline.com
-
http://sambukaclubonline.com
-
http://hlamidioz.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.4a037f781245f583de9e9e0f83303b26
- Size 191KB
- SHA256 4b8523492d9d06ebd9f8127b0414b249294dc08c9a8d70d0117ff363f134d4f5
- MD5 4a037f781245f583de9e9e0f83303b26
- SHA1 f83db552ad29266381694ec839da14653084ef3b
- SHA512 cb1cbad1ddcc64c81e34fe1009b024c5a5300e221c6bea994d068961415da35db6a0d345f75ee1ac2a21fa9cec92b628c1935b2723d37d0030b07638c9f00471
- SSDEEP 3072:cPrcNY+evWLpvP46kxl9NnBne6ItAKz1XOxf3tGcjeGShKuBaGirak5LXzgQzsOW:cANTevY4HdHIeKz1Of3njeG7ak5DzlzT
- TLSH T12E14E0F83550959FD0FE803069A399BBB3AD21D9C39449C6EE68533D2B6631CCC26F81
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.