cycbot | 84162951e9de0c0c0bde418ad43e75d1e48817d3bd6c22652667aaaab961eaf7

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3fd118ccd3fe7eca5f95796adc4d625e
Size 164KB
Sample261014-cp2zysev5t
SHA256 84162951e9de0c0c0bde418ad43e75d1e48817d3bd6c22652667aaaab961eaf7
MD5 3fd118ccd3fe7eca5f95796adc4d625e
SHA1 9da6fc082e247f66420774b4c00031ec561e2d51
SHA512 63046b1449bf33772152f0e5dea0c73af5af2f340ecc608d367082e64c12819a055288f3cb4d7db695bbfac3d600a67821fa9590b745e1c305113e44cca97d92
SSDEEP 3072:CCM2zrQtryXfpkc+pimi0bofFRD59JrzQBTXa3ysexxC6oPTd4xwhw:c8SyP+3fg/PQBTXTXxiPpDW
TLSH
T16CF301AE6333FC96F730117575592A72A16A7AA7B8419FCF33D8E226129F11CCB160C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.3fd118ccd3fe7eca5f95796adc4d625e
- Size 164KB
- SHA256 84162951e9de0c0c0bde418ad43e75d1e48817d3bd6c22652667aaaab961eaf7
- MD5 3fd118ccd3fe7eca5f95796adc4d625e
- SHA1 9da6fc082e247f66420774b4c00031ec561e2d51
- SHA512 63046b1449bf33772152f0e5dea0c73af5af2f340ecc608d367082e64c12819a055288f3cb4d7db695bbfac3d600a67821fa9590b745e1c305113e44cca97d92
- SSDEEP 3072:CCM2zrQtryXfpkc+pimi0bofFRD59JrzQBTXa3ysexxC6oPTd4xwhw:c8SyP+3fg/PQBTXTXxiPpDW
- TLSH
  T16CF301AE6333FC96F730117575592A72A16A7AA7B8419FCF33D8E226129F11CCB160C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2