cycbot | 84162951e9de0c0c0bde418ad43e75d1e48817d3bd6c22652667aaaab961eaf7

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 164KB
Sample261014-cp2zysev5t
SHA256 84162951e9de0c0c0bde418ad43e75d1e48817d3bd6c22652667aaaab961eaf7
MD5 3fd118ccd3fe7eca5f95796adc4d625e
SHA1 9da6fc082e247f66420774b4c00031ec561e2d51
SHA512 63046b1449bf33772152f0e5dea0c73af5af2f340ecc608d367082e64c12819a055288f3cb4d7db695bbfac3d600a67821fa9590b745e1c305113e44cca97d92
SSDEEP 3072:CCM2zrQtryXfpkc+pimi0bofFRD59JrzQBTXa3ysexxC6oPTd4xwhw:c8SyP+3fg/PQBTXTXxiPpDW
TLSH
T16CF301AE6333FC96F730117575592A72A16A7AA7B8419FCF33D8E226129F11CCB160C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/3500-11-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3792-12-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/1904-130-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3792-131-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot
behavioral2/memory/3792-279-0x0000000000400000-0x0000000000490000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\BBEBC\\9004C.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3500-11-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3792-12-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/1904-130-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3792-131-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral2/memory/3792-279-0x0000000000400000-0x0000000000490000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
908	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
908	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
908	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
908	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3500	3792	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 3792 wrote to memory of 1904	3792	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Modifies WinLogon for persistence
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\LP\4C5B\8CD.exe%C:\Program Files (x86)\LP\4C5B
  2⤵
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\BC4B2\lvvm.exe%C:\Program Files (x86)\BC4B2
  2⤵
  PID:1904

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\BBEBC\9004C.exe
1⤵
PID:4464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C4B2.BEB

Path C:\Users\Admin\AppData\Roaming\BBEBC\C4B2.BEB
Size 996B
SHA256 b0013b2d96b92e556cf2c73133b65b9637c9f5a983421f603d53b3ee179e2911
MD5 91fa8b5022d33ef59db7f025e794830b
SHA1 01f498043ebc542a167f895b6dd4c9756d4174c0
SHA512 1a189125fc759cd65b232874f7602708c22c1ae09a7355c21cbd2d5ffd92bc9aee72a656f2fc0f9920b86318c0f97d273924b7369ac9c6428d72db257e387847
TLSH
T1E8118C177BC80AA5C42806BB1247233133EAE797A280A38B944509E12CE2554D829AEC
MD5 SHA1 SHA512 TLSH

Submit Download

C4B2.BEB

Path C:\Users\Admin\AppData\Roaming\BBEBC\C4B2.BEB
Size 600B
SHA256 a211654f28c1b4ceadb99e3b410837769c6dde56e620339d2d6248ae8589f521
MD5 0ecb4fc0b849d027a02c181a0eebb936
SHA1 7d6c9a002ffb2bf9ff0bfa71c5fb17c205fa3c64
SHA512 4f996682a8c581f17aca1fae7c3c7727fdd54ab3812988a038d5a70b4862856645e6e7d7c1a0737ae3abfcba8d61e179450d20caa342809e30294cebf970be94
TLSH
T1DAF02203C2000202C0A00CFA0003032323CA2000A20023CB88080CE2BC00830C00CC3C
MD5 SHA1 SHA512 TLSH

Submit Download

C4B2.BEB

Path C:\Users\Admin\AppData\Roaming\BBEBC\C4B2.BEB
Size 1KB
SHA256 33d8416f53d55b4ecf75a189642972322b2ec10105c3360e85dbbe5d9de1b71d
MD5 fba5f075aaa5b6c2265c85094cef9325
SHA1 e16e15a328811e8f28786d5ece93074a6726d319
SHA512 b35bcb36b599bfb381b756543680b5ef39c14f4809aea7ed17b35beb2dbc3fa6de7939904460f956dc7a54efb6477f07f632613dbc470b37331447373f6759af
TLSH
T10D31C2573BC81EB5C418467B1347233033FAD79B62C1E78B954109A02DE3584DC35AD8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1904-130-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3500-11-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3792-1-0x0000000000620000-0x0000000000720000-memory.dmp

Download

memory/3792-12-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3792-13-0x0000000000620000-0x0000000000720000-memory.dmp

Download

memory/3792-131-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/3792-279-0x0000000000400000-0x0000000000490000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads