cycbot | 99966674d14a96e55693477dd2750558dc28e38e0cb62f677154a79695c3fd3a

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.5a9ed05b34df793a305c196587396faf
Size 171KB
Sample261014-dwphwaez4z
SHA256 99966674d14a96e55693477dd2750558dc28e38e0cb62f677154a79695c3fd3a
MD5 5a9ed05b34df793a305c196587396faf
SHA1 855665d3d86ae2350f896f06934b3b22d46ad21c
SHA512 0a9777192b433609926e2facfa91bfd531d250e0fc1ddbb2d849c53304aef639b9a30bbce85db6db464ad63046ddd1d62aba6cdf38c2570a620389e3884cbff2
SSDEEP 3072:C6M6KUYlncX2xb/BmE85LsUwCvt761EgMQsZY2aDytWkZRag3PsUka:LMblncX+FmE85LsUwCRk/M5aDytztPsy
TLSH
T13F04E0B7EF5B78A4F83B4532178C422C15ABA03E47847C3E6F98262571469350DBFB89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.5a9ed05b34df793a305c196587396faf
- Size 171KB
- SHA256 99966674d14a96e55693477dd2750558dc28e38e0cb62f677154a79695c3fd3a
- MD5 5a9ed05b34df793a305c196587396faf
- SHA1 855665d3d86ae2350f896f06934b3b22d46ad21c
- SHA512 0a9777192b433609926e2facfa91bfd531d250e0fc1ddbb2d849c53304aef639b9a30bbce85db6db464ad63046ddd1d62aba6cdf38c2570a620389e3884cbff2
- SSDEEP 3072:C6M6KUYlncX2xb/BmE85LsUwCvt761EgMQsZY2aDytWkZRag3PsUka:LMblncX+FmE85LsUwCRk/M5aDytztPsy
- TLSH
  T13F04E0B7EF5B78A4F83B4532178C422C15ABA03E47847C3E6F98262571469350DBFB89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2