General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.3be358ec2e8f8736a410df01f9e86e77
- Size 197KB
- Sample261014-cbx4vaey9k
- SHA256 0c9135d020e64683f4a24bc7ec86067f6cad59361d4859bcb524358b097a17e4
- MD5 3be358ec2e8f8736a410df01f9e86e77
- SHA1 74194096e2b994479d731b12b6871d09e0f659aa
- SHA512 37e61b8b430c2f1631b827466241d51461e364435397b9e1494ad58015742df562e0d436de8b1e9067afee88b9127d8d5a97a9c54c3087fc1bbef2743632e927
- SSDEEP 3072:kWt7mM+o52LHBOFUq3ro3cwJAZYe2STAXrJqmgSalJGPq5LF0FQMXDiqJbXem:kWtctHBOFvQH2cSWJqm2l1F0VXm7m
- TLSH T11714F16C903FC54DF83119F97E6BA33847B840636A8140F6BDE452697B83332AC56BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://worldmotoblo.com
-
http://resetmymemory.com
-
http://fastblogportal.com
-
http://freshmediaportal.com
-
http://yourimagearchive.com
-
http://myblogstoyou.com
-
http://stotre4image.com
-
http://allsoft4you.com
-
http://videocontainer.com
-
http://maxtroeurosys.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.3be358ec2e8f8736a410df01f9e86e77
- Size 197KB
- SHA256 0c9135d020e64683f4a24bc7ec86067f6cad59361d4859bcb524358b097a17e4
- MD5 3be358ec2e8f8736a410df01f9e86e77
- SHA1 74194096e2b994479d731b12b6871d09e0f659aa
- SHA512 37e61b8b430c2f1631b827466241d51461e364435397b9e1494ad58015742df562e0d436de8b1e9067afee88b9127d8d5a97a9c54c3087fc1bbef2743632e927
- SSDEEP 3072:kWt7mM+o52LHBOFUq3ro3cwJAZYe2STAXrJqmgSalJGPq5LF0FQMXDiqJbXem:kWtctHBOFvQH2cSWJqm2l1F0VXm7m
- TLSH T11714F16C903FC54DF83119F97E6BA33847B840636A8140F6BDE452697B83332AC56BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.