cycbot | f9f5ec51a4261517196cc1e3866973c4cd932f742e47bde4402ca14a8a8982ca

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3f06d7c0a6cca2eb42ed9c4664e63be8
Size 182KB
Sample261014-cnd7hatz7l
SHA256 f9f5ec51a4261517196cc1e3866973c4cd932f742e47bde4402ca14a8a8982ca
MD5 3f06d7c0a6cca2eb42ed9c4664e63be8
SHA1 483362828d80681e1cba4a78e34098453aefd0f1
SHA512 3cfae4837b6cf6ec9cc28277fdcb34a932c0ca41eca4b104c7784fe96ffce054a953bf8abe92d48853ad065abd458a452d8c1e3f38a2641454335b569fe45c49
SSDEEP 3072:ugGkBY/+jfvWF14LuYiktkfIhwxOY5+jq89xh1THF3L09jjV:u7kBlKF2LEIK95+j/bTl3L0FB
TLSH
T1960402DB2A32FC90F7B494B47257E131013D72E7B4005BEA63ADD122065F218AF676D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.3f06d7c0a6cca2eb42ed9c4664e63be8
- Size 182KB
- SHA256 f9f5ec51a4261517196cc1e3866973c4cd932f742e47bde4402ca14a8a8982ca
- MD5 3f06d7c0a6cca2eb42ed9c4664e63be8
- SHA1 483362828d80681e1cba4a78e34098453aefd0f1
- SHA512 3cfae4837b6cf6ec9cc28277fdcb34a932c0ca41eca4b104c7784fe96ffce054a953bf8abe92d48853ad065abd458a452d8c1e3f38a2641454335b569fe45c49
- SSDEEP 3072:ugGkBY/+jfvWF14LuYiktkfIhwxOY5+jq89xh1THF3L09jjV:u7kBlKF2LEIK95+j/bTl3L0FB
- TLSH
  T1960402DB2A32FC90F7B494B47257E131013D72E7B4005BEA63ADD122065F218AF676D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2